Block Access to private Gmail but allow corporate

cancel
Showing results for 
Search instead for 
Did you mean: 

Block Access to private Gmail but allow corporate

L1 Bithead

Hi all.

Im looking for a solution to block user access to private gmail accounts but allow a corporate accounts to be used.

I'm aware that there is a solution involing proxy server and X-forwarder.

Is there any other way to do this without dedicated proxy serever?

 

Regards

Leo

5 REPLIES 5

Community Team Member

Hi @Leonid.Rozgon,

 

I haven't tested this myself but you could try the following :

 

If I'm not mistaken for corporate Gmail access, the usernames have the customer domain name (eg. user@domain.com).

Personal Gmail accounts have usual usernames (eg. user@gmail.com)

 

To block personal gmail access, enable ssl-decryption.  Next, create a data pattern matching "@gmail.com".

Match this Data pattern on gmail-base app in a Data filtering object.

Apply the Data Filtering object to a policy.

 

This way you should be able to access corporate gmail accounts and personal gmail access should be blocked.

 

One caveat I think exists here :

Matching for the regex "@gmail\.com" in the whole page content might also have unwanted matches such as :

-Sending an email to somebody@gmail.com from the corporate account

-Reading an email from somebody@gmail.com on the corporate account

 

I would think along those lines ... other tips are welcome ^_^

 

Cheers !

-Kiwi.

LIVEcommunity team member, CISSP
Cheers,
Kiwi
Don't forget to hit that Like button if a post is helpful to you!

Thanks for the idea, Kiwi.

Trying to test/implement it, but I think the problem is that there is no option to add ssl or google-base as application in Data filtering profile(whys is that?). Authentication form for gmail is done through accounts.google.com and its not detected as gmail-base application. Will continue testing. If anyone else have any ideas feel free to wite them here.

 

Regards

Leo

1.jpg

Were you able to find anything out? I know Google has a way to block it on Chrome OS devices. 

L0 Member

Step 1 Make sure you are decrypting traffic from the inside to the outside

Step 2 Create a custom URL with *.google.com and *.gmail.com

               

Hectormorrell_0-1634946868945.png

 

 

Step 3 Create a URL FILTER  

Select HTTP HEADER Insertion

                Called it GMAIL-GOOGLE  Type Google apps Access control

                                Under domain add the following *.google.com and gmail.com

                                Select header X-GooApps-Allowed domain

                                Under value add your corporate domain example.com paloaltonetworks.com etc

You can add 5 domains

Hectormorrell_1-1634946868950.png

 

 

Hectormorrell_2-1634946868954.png

 

 

STEP 4 create a policy

INSIDE-2-OUTSIDE   Inside outside APPS GOOGLE-APPS service URL Category=GMAIL-COORPORATE Action= allow profile=url Filtering =GMAIL-FILTER

 

GOOGLE-APPS= GMAIL, Google-BASE, ssl, RTCP,rtp-base,stun,web-browsing vidyo           

 

Cyber Elite
Cyber Elite

Group.. i would recommend that the customer look at HTTP Header Insertion n under the URL Filter Profile section

 

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-new-features/app-id-features/http-header-inserti...

 

 

With the HTTP header insertion and modification feature, you can now manage HTTP header information to disallow SaaS consumer accounts while allowing a specific enterprise account.

 

 

Help the community: Like helpful comments and mark solutions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!