I need a guideline on how to block one particular user to access the Internet except facebook.com
I have created a policy with:
I have defined the Destination Address under Object as Type: FQDN facebook.com
However, I am getting error: This site cannot be reached.
Any other way, I can make this work?
Thanks in advance!
Solved! Go to Solution.
@Farzana : you'll want to allow the facebook application instead of a FQDN object
since facebook is hosted on 'the cloud' it will consist of many individual FQDN objects to signify each server. you'd need fqdn objects for many different servers for this to work
You would pretty much want something that looks like the following to do this effectivly. As @reaper has already mentioned, this isn't something that you need to use FQDN on and it's not really going to be recommended to do so since Facebook actually have a lot of different domains that they use to serve content. Facebook is able to be identified even if you are not currently doing ssl-decryption, so you're good there to.
So one rule that allows Facebook that looks something like this:
<entry name="Test-Facebook"> <to> <member>Untrust</member> </to> <from> <member>Trust</member> </from> <source> <member>any</member> </source> <destination> <member>any</member> </destination> <source-user> <member>wisleg\bpry</member> </source-user> <category> <member>any</member> </category> <application> <member>facebook</member> </application> <service> <member>application-default</member> </service> <hip-profiles> <member>any</member> </hip-profiles> <action>allow</action> </entry>
If you are dead set on using a destination filter outside of app-id then the IP ranges that are assigned to Facebook can be found by running a whois call like the following.
whois -h whois.radb.net -- '-i origin AS32934' | grep ^route
Currently that is returning the following:
Netblock Description Num IPs
|126.96.36.199/22||1 Temasek Avenue||1,024|
|188.8.131.52/22||Edge Network Services Ltd||1,024|
|184.108.40.206/24||Edge Network Services Ltd||256|
|220.127.116.11/24||Edge Network Services Ltd||256|
|18.104.22.168/24||Edge Network Services Ltd||256|
|22.214.171.124/22||Facebook Ireland Ltd||1,024|
|126.96.36.199/24||Facebook Ireland Ltd||256|
|188.8.131.52/24||Facebook Ireland Ltd||256|
|184.108.40.206/24||Facebook Ireland Ltd||256|
|220.127.116.11/21||Facebook Ireland Ltd||2,048|
|18.104.22.168/18||Facebook Ireland Ltd||16,384|
|22.214.171.124/19||Facebook Ireland Ltd||8,192|
|126.96.36.199/19||Facebook Ireland Ltd||8,192|
|188.8.131.52/22||Facebook Singapore Pte Ltd.||1,024|
If you do decide to go with the destination IP filter I would create all of the listed IP Ranges as an address object with a tag called 'Facebook', and then create a dynamic address-group that is tied to that tag. That way if/when Facebook adds another IP range, you just need to add it with the proper tag instead of updating the security policy itself.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!