Blocking Facebook for a group of USERS

[mbeghdadi]

Hello To All,

We've a PA-500 which is linked to the AD. The idea is to block Facebook for a group of users.

The thing is when those users will be logged (login and password), the AD update the PA-500.

To block facebook for those users, What should be done?

-1- Create a group of users

-2- Create a Policy which include those users and a Deny rule for facebook

DO we need something else?

Thanks for your support and comments.

Rgds

M

[lewis]

yes that is basically it, keep in mind if you are not doing ssl decryption on the social media url category blocked users will not get a blocked message. a solution if you are not ready for ssl decryption is to allow all users to get to the url category of social media but block by application. this will allow them to get to the login page but when they try to login they will get a block because of the application if they are not in your allowed group by application.

[mbeghdadi]

Thanks for your feedback,

How do you proceed on the policy.. Could you please give me an example on how to configure the policy rule?

[lewis · Accepted solution]

rule 1: allow Facebook AD group to access Facebook application(s), in the image below basically add your AD group in the users and assign a url profile allowing the social media url group (or custom group to just allow facebook url)

rule 2: block all users from Facebook applications, basically match above rule as a block.

rule 3: in your general surfing rule allow social media (or you custom group in rule 1) to avoid block messages if you are not doing ssl decryption

[mbeghdadi]

Thanks a lot for your quick support !!