09-19-2018 01:07 AM
I want to block all video treaming with palo alto. do do following this:
1, go to Objects--> URL fitering--> add new URL fitering with name block_video.
2, in categories, I check in streaming-media and choose block.
3, I create the policy with full internet, and in action tab --> URL fitering --> Block_video.
But users can access video normally, Please help to advise.
09-19-2018 04:48 AM
what does your url filtering log shows for these sessions? which category and url? is there ssl decryption in place?
09-19-2018 05:31 AM
it don't show any logs in URL filtering log. There is SSL decryption in place. I just want to block streaming-media and allow to access any websites.
09-19-2018 07:10 AM - edited 09-19-2018 07:13 AM
Are you sure, that you got a valid url filter licence on your PA?
If so, are you logging the sessions of that security rule, where your url filter policy is active?
09-19-2018 07:31 AM - edited 09-19-2018 07:32 AM
Generally speaking these policies are best effort; meaning that there are plenty of ways for users to bypass policies like this and they will need regular maintenance to continue to function as you intend as more services are brought online almost constantly.
What I'll generally do is create a rule that is simply to deny access to a subset of app-ids. This will simply include an application group with the service set to application-default and the action of Deny. This will block the specified applications whenever they are identified.
Then I'll create a general browsing rule below the above policy. The only thing special with this security rule is the assigned URL Filtering Profile is going to have whatever category I'm using (whether its the default 'streaming-media' category or a custom 'video-blocking' category) set to block.
With this setup the users will encounter an application block page whenever they get identified as using a blocked app-id, and the URL Filtering page when they navigate to something like plex.tv that the firewall identifes the URL before it identifies the app-id.
It would be helpful if you included a screenshot of how your policy is configured, there may be a simple mis-configuration.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!