Block known bad TLDs?

[grumpycat]

My CISO want's to block known bad TLDs (such as .zip or .review) in our Palo. I know how to block specific url(s), but is there any way to block an entire TLD?

I'm running into issues blocking *.zip since it will also block legitimate URL traffic that has *.zip* in its URL. 

[mvidic]

You could try to define custom applications using regex signatures for http GET requests and block those applications in the security rulebase.

[Lucky · Accepted solution]

Hi Grumpycat, welcome,

did you try blocking *.zip/ with the slash at the end? If that does not work, you might as well either accept false positives (and act upon them manually by allowing custom URLs reported to you in a separate whitelist) or trust to the other defensive mechanisms of firewall (vulnerabilities and threats protection, etc) and create separate custom category for any *.zip and set action to it as "continue", with fair warning to the users that they might be visiting malicious domain and to take extra caution...

Or, to alter suggestion by mvidic, try to play with regex, apps and custom signatures and try to allow certain longer urls that contain .zip in the URL (downloads of zip files...?) but I can't wrap my head around the fact that you want to block .zip but don't want to block it at the same time, can you share offending urls as examples so we can take a look at them perhaps?

Regards

Luciano

[BenjAudy.MTL]

Hi,

I just tried with the ".how" TLD and it blocks correctly with the filter "*.how/".

Benjamin

[Lucky]

Hi Benjamin,

FWIW - I think OPs problem was that *.zip filter caught more than they bargained for (it was also blocking any zip file download, I assume) 🙂 I am not sure how their specific .zip download URL was looking like.... all those download links are doing weird things with redirections and stuff, just to force-feed you more ads, maybe it was http://whatever.domain/some_file.zip/than_page_with_ads/something.html 🙂

Thanks for the quick test, tho, everyone appreciates some concrete and quick help.

Regards

[BenjAudy.MTL]

Actually, I tried the URL "http://www.howstuffworks.com/a.how" and the firewall doesn't block the request, so the filter seems to do what the OP wanted.

Regards,

Benjamin

[grumpycat]

I have not, but I will definitely try. Thanks for the suggestion!

[grumpycat]

Exactly. Here's a good example of the situation that I ran into when I tried to block ".zip/". 

I tested downloading FileZilla at 'sourceforge.net/projects/filezilla/files/FileZilla_Client/3.13.1/FileZilla_3.13.1_win32.zip/download?nowrap'

Looking in my Palo, this URL was blocked. I've also opened up a Palo support case to see if an engineer has any recommendations. Who knows, this may end up as a feature request. 🙂

[BenjAudy.MTL]

Which version of Pan-OS are you using? It works properly on my firewall (v6.1.6) :

Benjamin

[grumpycat]

I'm running 6.1.4. I guess it could be a versioning issue. Let me do some more testing to make sure I didn't flub up on something. I appreciate your ongoing help.

[Lucky]

Hi,

I am not sure how are you going to distinguish between 'something.zip/download?nowrap' and 'sourceforge.net/projects/filezilla/files/FileZilla_Client/3.13.1/FileZilla_3.13.1_win32.zip/download?nowrap'? .... and even something.zip can have subdomains and sub-subdomains, so you can't work around http:// neither....I think that your best guess is still to go with "continue" for this special category, if that matching of .zip/ does not work out 🙂

regards