Block Vpn

[sib2017]

Hi,

How to block ssl vpn and  ipsec vpn going from trust to untrust .

I suspect few users are using  like free vpn services like  tunnel beer and hola vpn .

How can i  search those users  from palo alto log.

Some users are connected from inside to outside world (for official purpose ) using cisco anyconnect (ssl ) and ipsec .And i don't want revoke their permission . ( I need only monitor those users ) 

Thanks

Thanks

[reaper · Accepted solution]

Hi Sib

as it's pretty difficult to differentiate between good and bad ipsec, i would recommend creating security policy based on user instead so you can allow certain users to have vpn tunnels while denying everyone else

please take a look at this article: Getting Started: User-ID

To be able to identify the different applications used you will need to enable ssl decryption: SSL decryption resource list

lastly, to control all vpn/encrypted tunnel applications, you can create a behavior based application group (called an application filter) which will automatically contain all applications that create encrypted tunnels, and use that in a security policy to control access to these applications

[pulukas · Accepted solution]

You should consider deploying a url filter that has the category for proxy avoidance/ anonymizers blocked.  This category is designed to block the activity you describe.