GOOGLE MAPS WHILE BLOCKING OTHER GOOGLE SERVICES

[j.moore]

Does anyone have any ideas on how to permit access to Google Maps but block access to all other Google services? I have tried using a rule matching the Google-Maps application however it requires google-base which allows many other Google services. I have also tried using custom URLs for maps.google.com and www.google.com/maps; however, Google maps seems to require access to resources at www.google.com/.

The customer is currently using a Squid proxy with detailed regex expressions to accomplish this. Below are some examples. They would like to remove the proxy and use the firewall only. 

acl ALLOWED_URL url_regex -i ^https?://www.google.com/favicon.ico$
acl ALLOWED_URL url_regex -i ^https?://www.google.com/images/branding/product/ico
acl ALLOWED_URL url_regex -i ^https?://www\.google\.com/(maps|xjs)
acl ALLOWED_URL url_regex -i ^https?://www\.google\.com/s(earch)?\?tbm=map
acl ALLOWED_URL url_regex -i ^https?://www\.google\.com/gen_204\?oq=

[vsys_remo]

Hi @j.moore

Why don't you add the same URLs (without regex) to your custom URL category?

[j.moore]

I tried that. It doesn't seem to match on the full string. I think Custom URLs only support domains and subdomains, not the variables. 

[BPry]

@j.moore,

You can't use variables for this. 

[j.moore]

I figured that. What other options do I have? 

[BPry]

@j.moore,

To do this easily and cleanly you don't really have any from the firewall directly. Google integrates all of their services pretty tightly and trying to limit all of Google but allowing Maps would require a very large amount of allowed URLs that will likely be constantly changing and breaking things. 

[j.moore]

Using a squid proxy this is fairly straightforward. Hoping this might be accomplished using the PA firewall only. 

[vsys_remo]

As they work with squid, did you add these urls to the custom url category?

www.google.com/favicon.ico
www.google.com/images/branding/product/ico
www.google.com/maps
www.google.com/xjs
www.google.com/search?tbm=map
www.google.com/s?tbm=map
www.google.com/gen_204?oq=

[j.moore]

Yes, but it fails to match the following.  I I think this is because PANOS only matches on domains, subdomains, and paths not Parameters. 

www.google.com/search?tbm=map
www.google.com/s?tbm=map
www.google.com/gen_204?oq=

[gwesson]

Are you doing SSL Decryption? Without decryption, the firewall doesn't even see the HTTP request for the maps page, it only sees the hostname of the server they're connecting to, in this case it's www.google.com as the host. Google uses a wildcard cert, so the response from the server is for *.google.com. Since neither is distinguishing the maps service, there would be no way to allow maps but deny others.

PAN-DB does categorize on full URIs, not just domains and hosts. A good example of this is any of the test sites:

https://pandb.paloaltonetworks.com/test-gambling

https://pandb.paloaltonetworks.com/test-phishing

Both of those pages are on the same host and domain, but different paths. PAN-DB will categorize them appropriately.

But if you're not decrypting the SSL (TLS) traffic, the only thing the firewall will see is a TLS Client Hello that has "pandb.paloaltonetworks.com" but not the full URI.