URL Filtering to block Facebook

[Momoj]

Hi all,

I been testing to do URL filtering with whitelist approach (allow some URL and block everything) and also create SSL decrypt policy. As I was checking, it seems like not working to block facebook. I check in the test a site, Facebook fall under social-networking.  When I check the log, there is no log under URL filtering that is hitting facebook. 

I also made some custom url category(attach it to URL filtering for blocking facebook), but still not hitting the custom url category:

*.facebook.com

connect.facebook.net/*

*.xx.fbdcdn.net/

Anybody have any idea on how to block facebook by URL filtering? The security rule is from trust to untrust and I set it allow, and attach the URL filtering.

[LAYER_8]

Is facebook showing up in the logs of allowed traffic? If not, FB could be using QUIC

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClarCAC

[Momoj]

Hi,

Actually, there is CASB client intercept the traffic for Saas Based traffic so we couldn't do anything from firewall side. The blocking need to do from CASB itself. Beside that, it seems like the url filtering is working other than SaaS based traffic.

[Adrian_Jensen]

We use the following custom URL category for selectively allowing/blocking Facebook:

fb.com/

*.fb.com/

facebook.com/

*.facebook.com/

facebook.net/

*.facebook.net/

fbcdn.net/

*.fbcdn.net/

Either as a category in URL filtering, or as a modifier for specific destinations in a Security Policy. You can usually do overall blocking without SSL decryption (with just the SNI), but doing all SSL decryption leads to far better pattern matching.