blocking google apps via URL

[holemans]

Our users are getting on a regualar base phishing mails in which they are asked to fill in their username and password by clicking on a link.

We don't have the URL categorizing license but are using URL filtering via custom URL filtering and that works fine (most of the time). We put the links of the phishing mails in the custom URL category with block as action.

As already told, this works fine except for the latest addition : a phishing site on google docs.

I copied the URL from the mail as always and added it to the list but it won't block for an unknown reason.

This is the URL we want to block : "docs.google.com/spreadsheet/viewform?formkey=dFFDMXVDYlUzZ05iTkpmc0o3M1Ewd1E6MQ"  (it is a https: URL).

Does it matter that this is a https URL instead of a http URL ? Is is possible the URL matching isn't done because PA recognises this as an app ? The traffic log shows it as an ssl application.

I even tried with formkey=*  as a test but even that didn't work.

Anyone a suggestion on what i'm doing wrong or on how to block URLs like this ?

Wim Holemans

[zarina]

As this is SSL, we need to decrypt the traffic so that we can look at the url inside. When you have decryption in place, you should be able to block the url you referred to.

As a test, I tried to access the docs and it shows up as "0.drive.google.com/"

[koziny]

Hi,

What version are you running on PAN? 

I had the same issue. When I updated my PANs from 4.1.6 to 4.1.9 version I was able to block "docs.google.com" through an URL filtering.