Proxy avoidance Issue

[homicidedart]

Hello Gents,

We are facing an Issue with Palo Alto 5050, since we found some web proxies not seen by the Appliance, like

https://incloak.com/

and most of the dynamic proxies in this website are working

https://proxy.org/

Regards,

Maher

[jvalentine]

They seem to be blocking on my Palo Alto Networks firewall.  Do you have the "proxy-avoidance-and-anonymizers" category set for block? 

[homicidedart]

Hi Jared,

I don't have URL license, I'm using only application filters. So I blocked all proxy and encrypted tunnels applications. and it doesn't work.

Regards,

Maher

[jvalentine]

Do you have an SSL Decryption policy configured and in use?  Without decryption the application will be viewed as ssl, which I assume is permitted in your security policy.

[homicidedart]

Yes, I've decryption policy in use that decrypts all the traffic.

Appreciated.

Maher

[panos]

You can use fqdn objects (in destination ip) for these two url and deny any traffic.So sites will not work even you use or  do not use decryption.

[homicidedart]

Hi panos,

thanks for your support, but it's not allowed to use FQDN in the destination IP.

Regards,

Maher

[panos]

You should first create these as fqdn object like below

Then you can use these objects inside policy

[panos · Accepted solution]

Alternatively

if you use decryption you can easly use custom url objects and Url filtering profile without URL license.

you don't need a license for that.Just select this url profile for the realted traffic's policy.

[homicidedart]

Thanks panos,

all is going very well now.

Appreciated.

Maher