Dropbox (again)

[depps]

Hello,

We have a requirement to do the following

Block dropbox for some users

Allow dropbox web for some users but block app - use ssl decryption to control uploads

Allow ALL for 2 VIP's - no decryption required

Is this at all possible?

[HULK]

Hello Deeps,

Following solutions may  be helpful in this scenario :

How to allow/block Dropbox application

Re: Dealing with Drop Box

Re: Dropbox - allow web app but block client?

Dropbox

Thanks

[depps]

Those links dont say how to enable both decryption of dropbox web traffic but also still keep the application working for certain users.

It appears its not possible as dropbox web and app appear as the same application.

Is it possible to create an decryption rule that excludes dropbox decryption for only 2 users thus allowing a few important users access to both the web and desktop app?

[jteetsel]

Hi depps, you cannot decrypt based on application since the PAN would need to decrypt the traffic to see what app it is in the 1st place. You would need to create a security policy to allow drop box for the source users in question, then create another policy that denies the app for the rest. For your non decryption VIPs, you could create a decryption policy that contains to the users in question (in the source) with the action of 'no-decrypt'. Then another policy below that that applies to the rest of the users below this policy, with the action set to 'ssl-forward-proxy'

[knutelde]

yes but the actual problem here is that decyption does not work for all parts of for example dropbox, linkedIN and others. so if you want your users to have access to these applications, then decypt is not an option (as far as I know) and thus controlling the application is not that straigth forward as it could have been, if decyption had worked.