Ultrasurf Blocking Fail

[Mohammad]

Hi,

I am suferring from many failed attempts trying to block ultrasurf. i added the application to a deny policy on the top of my policies, but users keeps jumping to the allow policy. i tried to block unkown UDP/TCP apps, but it failed too. the applcation itself can't be blocked even though i blocked all the dependecies. i tried to do it on 5050 and 5060 on both PAN 5.0.11 and PAN-OS 6.0 with the most updated licenses.can some one help. i guess it's considered a huge problem

[HULK]

Few related discussions, it might help you:

Re: How to block Ultrasurf?

Re: Ultrasurf 13.03 appearing as unknown-tcp

Re: unknown-tcp / udp - please explain

Thanks

[panos]

There is an open case for that.It is not fixed yet.

[HULK]

Could you please update the case ID here.

Thanks

[panos]

00171473

Thanks for help

[HULK]

Engineering is still working on this BUG. Fix is not available yet.

Thanks

[malswealmeen]

the same story with kproxy and freegate !!!:smileyshocked:

[cpainchaud]

Hi,

Does it still happen with Decryption enabled and Block sessions that cannot decrypted ? With that my own tests show it cannot get through .... Also it's useless to say unknown-tcp and unknown-udp should be blocked ...

[malswealmeen]

Hi ,

the unknown-tcp and unknown-udp are blocked but should the PA block them without the need of ssl decryption policy ( i mean if we have the right signature of the application) ?!

[panos]

with ssl decryption you will identify the real app. inside the ssl, so if you see only unknown tcp/udp , after decryption it will not change.

But if you see ssl, then it may change.

Until last version of ultrasurf, we were able to block it without decryption.