Block http traffic to numeric URLs

[adminatspace]

Hi,

I was ordered to block all http and hhtps traffic to addresses without a dns name. In other words user have to put in a network name in the browser and are not allowed to type an IP address in the address field.

As the thinking behind is blocking malware communication I have to block this traffic at the firewall and not at the browser. So I tried to setup a custom URL category with a site in the regexp form:

([0-9])+([0-9])?([0-9])?\.([0-9])+([0-9])?([0-9])?\.([0-9])+([0-9])?([0-9])?\.([0-9])+([0-9])?([0-9])?

but this doesn't seem to work, although this was declared in the Data Patterns section of the online help ( ..PAN_help/en/wwhelp/wwhimpl/js/html/wwhelp.htm#href=security.05.5.html )

Is there any smarter way to block access to numeric addresses without setting up more the 4 billion entries in a list?

thank You in advance

Peter

[pankaku]

We can try doing by creating custom vulnerability profile. Here in pattern we can specify regex

[adminatspace]

Thank You for the fast answer, I will have to look at this in detail on beginning of next week. I will give feedback if i was successful.

Peter

[BenjAudy.MTL · Accepted solution]

Hi,

Websites accessed using the IP address end up in the "unknown" URL category, so you could just block that category. You will also block uncategorized URLs, but those are often malware sites anyway.

Benjamin

[adminatspace]

today I tried to set up a Custom Vulnerability Signature, like pankaj.kumar said, but I didn't succeed. I got the following error message:

Operation failed

threats -> vulnerability -> 41000 -> signature -> standard -> RY_Numeric_IP_Sign -> and-condition -> And Condition 1 -> or-condition -> Or Condition 1 -> operator -> pattern-match -> pattern '([0-9])+([0-9])?([0-9])?\.([0-9])+([0-9])?([0-9])?​ \.([0-9])+([0-9])?([0-9])?\.([0-9])+([0-9])?([0-9]​)?' is invalid. pattern must be at least 7 bytes
threats -> vulnerability -> 41000 -> signature -> standard -> RY_Numeric_IP_Sign -> and-condition -> And Condition 1 -> or-condition -> Or Condition 1 -> operator -> pattern-match -> pattern is invalid

 I will also take a look at the "unknown" category, but I'm a bit afraid this will give a lot false positives. 

[clewis1]

In regards to the 'unknown' blocking, it can create false positives but a lot of the time it is not work related traffic in our enviroment. We have implimented about a 75% block on 'unknown traffic by dropping 'unknown' url traffic to countries we do not typically do businesss with or where we feel it has been mostly malicious. Initially this left us with two countries which we are allowing 'unknown' url to. Howerver, we now have started to slowly block these countries by taking small internal ip blocks and monitoring this traffic looking for legit traffic (which somitimes is ip based urls) and recatergorizing or adding to a custom allow url profile. We have had a couple where users had to log a call to have us look at them but for the most part it has been a pretty smooth implementation other than being a bit slow.

[Raido_Rattameister]

We block unknowns also.

If some new business related site pops up and users need access now not in 3-5 days when Palo has picked it up from Passive DNS monitoring then I just add this new site to custom url category and send url recategorization request to Palo.

Usually in 24 hours site is categorized and I can remove exclusion from custom url category.