HTTP Tunneling

[snormoyle]

Wondering how the Palo Alto detects HTTP tunneling and how would a security policy be configured to detect/prevent this situation.

[rmonvon]

Can you describe what you means by HTTP tunneling?

Currently there are 42 proxy applications like phpproxy, http-tunnel, freegate, etc.  For example, the phpproxy app will detect anonymizer sites that are based on php engine.

Thanks.

[snormoyle]

I am referring to the http connect tunnel

[rmonvon]

For HTTP connect, the app is http-proxy as the connect method is employed between the browser and a proxy server.  So to block HTTP connect, you would deny http-proxy.

Thanks.