Block websites when using VPN

[nredaj]

Some users started to use SoftEther VPN client on our company which allows them to bypass URL Filtering policy. How can we allow them to use VPN client but still allow or block access to certain websites. We already implemented SSL decryption rule but it is not working when they are using SoftEther VPN. 

[kiwi]

Hi @nredaj ,

Is decryption working ?

How is the traffic identified by the firewall ?

Cheers,

-Kiwi.

[nredaj]

Hi @kiwi ,

Decyption is working. Based on monitoring logs, when using VPN client, all traffic are identied as:

Application: SSL

IP Protocol: TCP

Port: 443

Category: computer-and-internet-info

[kiwi]

Hi @nredaj ,

How is decryption working ?

If the application is identified as SSL then decryption isn't working.

Note that on some scenarios decryption is impossible ... for example when unsupported protocols or ciphers are used or with certificate pinning for example.

Cheers,

-Kiwi.

[nredaj]

Hi @kiwi ,

It says decrypted. The problem is that users need to use SoftEther VPN to access certain website. But using this VPN client can bypass all our security rule in place. May be we can find another way to access the website without using VPN. 

Thank you very much @kiwi 

[kiwi]

Hi @nredaj ,

You might be hitting this which could explain why a decrypted session is still showing up as SSL :

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cle8CAC

Have you checked with support already ?

Cheers !

-Kiwi,

[Mick_Ball]

Hmm, I think the ssl decryption here will not be as helpful as usual.   you will only decrypt the outer wrapper (the actual tunnel) any ssl packets running through the tunnel will not be decrypted as negotiation for these will have taken place end to end via the tunnel, not the palo.

[BPry]

@nredaj,

I would agree with @Mick_Ball in this case. Decrypting this traffic isn't going to give you much information and won't allow you to actually perform URL FIltering; this is actually the exact reason VPNs are recommended on untrusted networks, the network operator can't decrypt enough of the traffic to actually see anything useful. 

[nredaj]

I understand that this could be out of Palo Alto's FW scope. 

This is a bit frustrating. Configuring static route in client side (windows OS) could have solve this issue but the website they're accessing is going thru CDN which cause IP address to change from time to time. Probable solution may be work out with SoftEther VPN configuration.

Thank you guys for all your inputs.