I was ordered to block all http and hhtps traffic to addresses without a dns name. In other words user have to put in a network name in the browser and are not allowed to type an IP address in the address field.
As the thinking behind is blocking malware communication I have to block this traffic at the firewall and not at the browser. So I tried to setup a custom URL category with a site in the regexp form:
but this doesn't seem to work, although this was declared in the Data Patterns section of the online help ( ..PAN_help/en/wwhelp/wwhimpl/js/html/wwhelp.htm#href=security.05.5.html )
Is there any smarter way to block access to numeric addresses without setting up more the 4 billion entries in a list?
thank You in advance
Solved! Go to Solution.
today I tried to set up a Custom Vulnerability Signature, like pankaj.kumar said, but I didn't succeed. I got the following error message:
I will also take a look at the "unknown" category, but I'm a bit afraid this will give a lot false positives.
In regards to the 'unknown' blocking, it can create false positives but a lot of the time it is not work related traffic in our enviroment. We have implimented about a 75% block on 'unknown traffic by dropping 'unknown' url traffic to countries we do not typically do businesss with or where we feel it has been mostly malicious. Initially this left us with two countries which we are allowing 'unknown' url to. Howerver, we now have started to slowly block these countries by taking small internal ip blocks and monitoring this traffic looking for legit traffic (which somitimes is ip based urls) and recatergorizing or adding to a custom allow url profile. We have had a couple where users had to log a call to have us look at them but for the most part it has been a pretty smooth implementation other than being a bit slow.
We block unknowns also.
If some new business related site pops up and users need access now not in 3-5 days when Palo has picked it up from Passive DNS monitoring then I just add this new site to custom url category and send url recategorization request to Palo.
Usually in 24 hours site is categorized and I can remove exclusion from custom url category.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!