topic Palo alto not blocking a URL in General Topics

Palo alto not blocking a URL

Ankurdatta — Mon, 13 Jul 2020 09:00:46 GMT

Hi All,

I hope all are doing well.

I am trying to block a URL on palo alto firewall using custom URL category but firewall is not blocking the traffic and its passing through allow SSL/Web-browsing rule just below it.

This is the rule i created:

Rule 4 is allow rule to access websites, whereas rule 2 is used to block the URL - https://natboard.edu.in/

I created custom URL category:

*.edu.in
*.edu.in/
*.natboard.edu.in
https://natboard.edu.in/
natboard.edu.in

Traffic is not hitting rule 2 and traffic goes through rule 4. I created custom application as well by checking server name in wireshark in SNI field - Server Name: natboard.edu.in but it also not worked. rule number 3

I am decrypting SSL traffic as well.

Kindly advise.

Thanks

Re: Palo alto not blocking a URL

nbutter — Thu, 16 Jul 2020 13:50:18 GMT

Hi,

I was able to block this successfully using the following setup. I also included the wireshark debug for the site. SNI (Server name indication) allows you to block without actually decrypting the traffic, since this field is unencrypted.

Have a good day,

Re: Palo alto not blocking a URL

SutareMayur — Fri, 17 Jul 2020 13:15:30 GMT

@AnkurdattaTraffic logs and cli test commands may give you more clarity on why traffic is not matching expected security policy.

Mayur