Layer7 Filtering - Bad Bots

[AmyTyler]

Hi all,

I'm new to PAN OS and working on a project to migrate from a Cisco ASA to a PA 5020.

With the migration I need to bring over a policy that drops http traffic with a user-agent header matching on a regx.

I've created a custom vulnerability (see attached), but don't really have a way to test it out.

Is a custom Vulnerability the best approach to this type of layer 7 filtering, or is a custom application the better way to go? Other recommendations?

Also, does my pattern match look correct in the attached?

Thank you.

[panos · Accepted solution]

Hi,

I think custom application will be better.

Also check this for information

https://live.paloaltonetworks.com/message/25949#25949

[ericgearhart]

Why can't you test it? Couldn't you use Firefox with User Agent Switcher and a custom user agent to "pretend" to have the user agent you're trying to block?

[AmyTyler]

Thanks for the tip, egearhart. I'll research using Firefox to do that. I am also looking into what I can do with "wget" for testing

[ericgearhart]

OK, no problem, glad I could help!

[AmyTyler]

Created a custom application and it appears to be working for me.

Thanks for the tip.