Block web browsing but allowing other apps.

L3 Networker

Block web browsing but allowing other apps.

I need to block webbrowsing but allow other apps which has web dependency.

Trust to untrust - all allowed. But when I deny webbrowsing from trust to untrust other apps like skype stops working.

Requirement is only web-proxy ip is allowed webbrowsing from trust to untrust.

How do we overcome this issue.


L7 Applicator

You can't allow apps that depend on web-browsing and block web-browsing at the same time.


There are few exeptions. One example is Facebook. Based on SSL certificate Palo can identify it and let it through even if web-browsing is blocked.


But usually HTTP GET follows TCP 3way handshake and based on server reply traffic is identified as web-browsing. Exact application is identified later when more traffic is seen.

Year ago when I troubleshot Captive Portal issue I saw that Skype sent HTTP GET to (there might be more but this is what Skype was hammering when Captive Portal was blocking traffic) so if you look where your apps connect to you might be able to create custom URL category and permit only those limited sites.

Enterprise Architect @ Cloud Carib
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!