Custom App for CRL downloads

[dennisss]

Hi,

I am trying to create a custom app that will match CRL downloads, to allow them without any questions ask. Shouldn't be too hard : on a previous web security gateway, I would match a pattern like the following: "http://([^/:])*crl.*\.crl"

When translated to an app signature, I already know I am looking for two patterns, on the following contexts:

• http-req-host-header
• http-req-uri-path

Now, my issue is that my pattern are incredibly simple. I am not able to reach the 7 bytes limit with this. One other way would be to match the MIME type in the RSP header I guess... application/pkix-crl or application/x-pkcs7-crl are fine. The issue is with the occasional misconfigured root CAs that still reports text/plain.

So....  Is there anything I can do with this to simply allow CRLs without creating a huge custom category?

Thank you.

[AlexNC]

Hi There

So are you running the app successfully now in your environment?

I have it deployed on a larger scale now and so far if i add a URL filterping profile with alert for all alloed categories I do see only *.crl files in the URL log hitting. But in traffic Log I have a lot more hits (to the same public IPs) then what I have in the URL log.

Regards

Alex

[Sec101]

Yes, appears to be working ok for us.

[hebejena]

I wonder if even the latest version can do that?

[AlexNC]

Hi Hebejena

How do you mean "if the latest version can do that" do you mean if there is a app-id or a built in way from Palo Alto to cover this use-case with their latest PAN-OS releases? 

Regards

Alex

[Sec101]

That would be ideal really.  Something that would cover all .crl cases.

[LuisMG]

shouldn't be all "/" escaped?

.*((application/pkix-crl)|(application/x-pkcs7-crl)|(text/plain)|(application/octet-stream)).*

like this

.*((application\/pkix-crl)|(application\/x-pkcs7-crl)|(text\/plain)|(application\/octet-stream)).*

Just guessing because it was not working for me.