Blocking Google Images

[tom.mccomb]

Howdy everyone,

We have a strict internet usage vlan where users can only hit an Approved List of URLs that we manage through Panorama.  The issue is that some of these fights reference Google as part of the CDNs so we've had to allow them in to the Approved URL filter.

This has been working for a long time, but a few users learned that they can still look up images from their workstation and now management wants this removed instead of having a conversation with the end users.  Lovely.

There is an old thread where a user was able to Block Google Images with an App-Id but this was in a 4.x version. https://live.paloaltonetworks.com/t5/General-Topics/Blocking-Google-Images-Content/m-p/30312#M22164

Has anyone had success doing this on an 8.x release?  If it was a custom-app ID, what were you using to define the traffic?  

[BPry]

@tom.mccomb,

So to be clear, you have to allow some Google images while attempting to block users from viewing others. This really isn't going to go over all that well, as Google takes active steps to prevent people from being able to do so. If you want to block them all that's a different story, but allowing some while blocking others doesn't work. 

[tom.mccomb]

@BPry Not exactly.  We have other websites in our Approved URL list that apparently use Google resources to allow the page to be displayed properly.  For example the fake website www.mywebsite.com failed to load all the elements on the page and was pretty unusable, after using fiddlr, wiresharks etc we found that it was making calls out to Google for additional resources.  Once we allowed those URLs through the filter, the website would load properly.

Unfortunately, this had the side effect of allowing users to visit www.google.com and perform web searches, visiting google images etc.  I was able to create Custom Threat policies to block the google browser based games but I can't seem to find much that would restrict them going to google images.  One user was looking at DIY halloween costumes and their manager wants us to stop his people from doing all of that.

Definitely not the easiest of situations, but unfortunately we are not in the position to tell the business NOT to use a particular website due to functionality issues.