Ultrasurf again - still getting through, how to block?

[mtizani]

Hi, 

Even though the PA firewalls is detecting the traffic is Ultrasurf, the application is still working. 

I've got a security rule to block by application 'Ultrasurf', and we have SSL decryption as well. 

thanks

[mtizani]

Can see the traffic log here.

[Hithead]

first ssl and web-browsing allowed the traffic until ultrasurf could be detected...

i would suggest to block the url category proxy-avoidance-and-anonymizers

[Brandon_Wertz]

Yeah, like @Hithead said the application wasn't allowed, your logs state the connection was reset once Palo was able to identify the traffic as Ultrssurf.

In most cases Palo will "allow" the traffic to pass, then an application shift occurs and once that shift happens the traffic is stopped.

How long was the total session (packets)?  From your screen shot, to me 3 seconds wouldn't be long enough to really get passed your security policy.