X-VPN not getting decrypted

[Farzana]

Hello,

We would like to block the application X-VPN (used on apple iOS system as a VPN app). Using PAN-OS 8.0.1
The firewall sees the traffic as either SSL, web-browsing or google base traffic and doesn’t appear to be decrypting it.

The session ID says the URL is for bing.com in the session but the destination is 104.156.232.205.vultr.com which is where the VPN is hosting their services.

We have tried the following:

Change service (under Policies/Security) to application-default

Select block all sessions (under Objects>Decryption Profile>SSL Proxy)

Any thoughts on this?

Thanks in advance.

[cwscotty]

Hi,

Just wondering if this is still the way you are blocking X-VPN, and is it effective?

Cheers,

Chris

[fredrickstanley]

Setting up a signature is an option that might work for these types of programs, but it would be only a temporary solution.

      Sadly, students seem to always figure out a way to continue to bypass our firewall. I would suggest your organization provided a ticket system to allow your students to request the usage of certain websites or applications. Generally, students will try to access a site(such as youtube.com, which is commonly used for entertainment, research and studies), and are often annoyed that it is blocked, leaving them to attempt other methods that could put their device and your network at risk. Figuring out what sites students would prefer unblocked and if the application is not considered harmful, this allows students to turn to these methods rather than trying to "bypass" the restrictions. 

       If you are concerned about students using certain sites for malicious purposes, you can include the rights and limitations of the specific type in your organization's Acceptable Use Policy.

[fredrickstanley]

Is there anything malicious they are doing with this VPN?