Custom App Signature to detect Firefox User Agent - not working on *some* https traffic

Reply
L1 Bithead

Custom App Signature to detect Firefox User Agent - not working on *some* https traffic

Hi,

recently I have been 'forced' through a support call to look into custom application signatures for the first time.

The requirement is  to detect and block the Firefox UserAgent string (the usefulness of blocking something as easily spoofed like this at gateway level is not part of the problem :smileywink: )

The patterns were identified by the customer already and quickly verified by myself - we're looking Gecko/<some numbers> Firefox/<some number>0.00

The signature I've build will follow at the bottom.

The Problem:

The signature does not work for all https sites.

It works fine for all http sites which I've tested, and works also fine for *some https sites* (e.g. https://www.google.co.uk, https://www.bbc.co.uk).

But for others (e.g. https://www.facebook.com, https://www.linkedin.com) it does not (i.e. the website is displayed instead of blocked, based on the browser which is used (Firefox 30))

Needless to say, https inspection is enabled on my test device, certificate is imported into the browser etc.

Using fiddler, I have confirmed that the GET requests for those sites are looking identical compared to the ones where it is working.

Tested on PanOS 6.0.0 as well as 6.0.3

Anybody got any ideas?

Thanks!

Roland

The signature:

<application>
     <entry name="UserAgent_Firefox">
          <signature>
               <entry name="detect_firefox_userAgent">
                    <and-condition>
                         <entry name="And Condition 2">
                              <or-condition>
                                   <entry name="Or Condition 1">
                                        <operator>
                                             <pattern-match>
                                                  <qualifier>
                                                       <entry name="http-method">
                                                            <value>GET</value>
                                                       </entry>
                                                  </qualifier>
                                                  <pattern>\ Gecko/[0-9]*</pattern>
                                                  <context>http-req-headers</context>
                                             </pattern-match>
                                        </operator>
                                   </entry>
                              </or-condition>
                         </entry>
                         <entry name="And Condition 3">
                              <or-condition>
                                   <entry name="Or Condition 1">
                                        <operator>
                                             <pattern-match>
                                                  <qualifier>
                                                       <entry name="http-method">
                                                             <value>GET</value>
                                                       </entry>
                                                  </qualifier>
                                                  <pattern>Firefox/.0\.0</pattern>
                                                  <context>http-req-headers</context>
                                              </pattern-match>
                                        </operator>
                                   </entry>
                              </or-condition>
                         </entry>
                    </and-condition>
                    <scope>session</scope>
                    <order-free>no</order-free>
                </entry>
          </signature>
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!