Block http traffic to numeric URLs

Reply
L1 Bithead

Block http traffic to numeric URLs

Hi,

 

I was ordered to block all http and hhtps traffic to addresses without a dns name. In other words user have to put in a network name in the browser and are not allowed to type an IP address in the address field.

 

As the thinking behind is blocking malware communication I have to block this traffic at the firewall and not at the browser. So I tried to setup a custom URL category with a site in the regexp form:

 

([0-9])+([0-9])?([0-9])?\.([0-9])+([0-9])?([0-9])?\.([0-9])+([0-9])?([0-9])?\.([0-9])+([0-9])?([0-9])?

 

but this doesn't seem to work, although this was declared in the Data Patterns section of the online help ( ..PAN_help/en/wwhelp/wwhimpl/js/html/wwhelp.htm#href=security.05.5.html )

 

Is there any smarter way to block access to numeric addresses without setting up more the 4 billion entries in a list?

 

thank You in advance

 

Peter


Accepted Solutions
L4 Transporter

Hi,

 

Websites accessed using the IP address end up in the "unknown" URL category, so you could just block that category. You will also block uncategorized URLs, but those are often malware sites anyway.

 

Benjamin

View solution in original post


All Replies
L5 Sessionator

We can try doing by creating custom vulnerability profile. Here in pattern we can specify regex

 

chrome_2016-06-17_09-16-40.png

L1 Bithead

Thank You for the fast answer, I will have to look at this in detail on beginning of next week. I will give feedback if i was successful.

 

Peter

L4 Transporter

Hi,

 

Websites accessed using the IP address end up in the "unknown" URL category, so you could just block that category. You will also block uncategorized URLs, but those are often malware sites anyway.

 

Benjamin

View solution in original post

L1 Bithead

today I tried to set up a Custom Vulnerability Signature, like pankaj.kumar said, but I didn't succeed. I got the following error message:

 

Operation failed
 
threats -> vulnerability -> 41000 -> signature -> standard -> RY_Numeric_IP_Sign -> and-condition -> And Condition 1 -> or-condition -> Or Condition 1 -> operator -> pattern-match -> pattern '([0-9])+([0-9])?([0-9])?\.([0-9])+([0-9])?([0-9])?​ \.([0-9])+([0-9])?([0-9])?\.([0-9])+([0-9])?([0-9]​)?' is invalid. pattern must be at least 7 bytes
threats -> vulnerability -> 41000 -> signature -> standard -> RY_Numeric_IP_Sign -> and-condition -> And Condition 1 -> or-condition -> Or Condition 1 -> operator -> pattern-match -> pattern is invalid

 

Clipboard03.jpgClipboard02.jpgClipboard01.jpg

 

 I will also take a look at the "unknown" category, but I'm a bit afraid this will give a lot false positives. 

L2 Linker

In regards to the 'unknown' blocking, it can create false positives but a lot of the time it is not work related traffic in our enviroment. We have implimented about a 75% block on 'unknown traffic by dropping 'unknown' url traffic to countries we do not typically do businesss with or where we feel it has been mostly malicious. Initially this left us with two countries which we are allowing 'unknown' url to. Howerver, we now have started to slowly block these countries by taking small internal ip blocks and monitoring this traffic looking for legit traffic (which somitimes is ip based urls) and recatergorizing or adding to a custom allow url profile. We have had a couple where users had to log a call to have us look at them but for the most part it has been a pretty smooth implementation other than being a bit slow.

L7 Applicator

We block unknowns also.

If some new business related site pops up and users need access now not in 3-5 days when Palo has picked it up from Passive DNS monitoring then I just add this new site to custom url category and send url recategorization request to Palo.

Usually in 24 hours site is categorized and I can remove exclusion from custom url category.

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!