Hello   Thank you for the detailed steps in getting Split Tunnel working, I am stuck at the same part but I am running OSX on Macbooks and this option does state (windows only) do you know how this is achieved with OSX.    I've configured everything as you mentioned (except the App feature for all FQDNS,since it's Windows Only) But when connected to VPN, I see that all public queries done with nslookup are done by the configured DNS Servers in the GP Settings.   Thank you and best regards Duque ... View more

Hi There   So are you running the app successfully now in your environment? I have it deployed on a larger scale now and so far if i add a URL filterping profile with alert for all alloed categories I do see only *.crl files in the URL log hitting. But in traffic Log I have a lot more hits (to the same public IPs) then what I have in the URL log.   Regards Alex ... View more

Hi There To be honest the User Agent part was already in there. I just took the app, tried it..... tried to so what wireshark says/shows and searched some documents on how the string should look. if I recall correctly there is only a difference was pattern matching and changing it to "session" instead of "protocol-data-unit" after that it worked and I added the case for "application/octet-stream" since I found some CRL Pages sending it like that. I don't know or do much with custom App-ID so maybe someone else can weigh in on it.   Regards Alex     ... View more

<application version="9.1.0"> <entry name="APP_CRL_VAL"> <signature> <entry name="GET CRL File"> <and-condition> <entry name="And Condition 1"> <or-condition> <entry name="Or Condition 1"> <operator> <pattern-match> <qualifier> <entry name="http-method"> <value>GET</value> </entry> </qualifier> <pattern>.*\.crl HTTP.*User\-Agent.*</pattern> <context>http-req-headers</context> </pattern-match> </operator> </entry> </or-condition> </entry> <entry name="And Condition 2"> <or-condition> <entry name="Or Condition 1"> <operator> <pattern-match> <pattern>((application/pkix-crl)|(application/x-pkcs7-crl)|(text/plain)|(application/octet-stream)).*</pattern> <context>http-rsp-headers</context> </pattern-match> </operator> </entry> </or-condition> </entry> </and-condition> <scope>session</scope> <order-free>no</order-free> </entry> </signature> <subcategory>infrastructure</subcategory> <category>networking</category> <technology>client-server</technology> <description>matches CRL download</description> <risk>2</risk> <evasive-behavior>no</evasive-behavior> <consume-big-bandwidth>no</consume-big-bandwidth> <used-by-malware>no</used-by-malware> <able-to-transfer-file>no</able-to-transfer-file> <has-known-vulnerability>yes</has-known-vulnerability> <tunnel-other-application>no</tunnel-other-application> <tunnel-applications>no</tunnel-applications> <prone-to-misuse>no</prone-to-misuse> <pervasive-use>no</pervasive-use> <file-type-ident>no</file-type-ident> <virus-ident>no</virus-ident> <data-ident>no</data-ident> <default> <port> <member>tcp/80</member> </port> </default> </entry> </application> This is the app that I got to work and added a 3rd way that I found within the wireshark traces. But again, this is my first attempt on getting anything working with a custom PAN app-id and I used the base application provided within this Post. Without that I wouldn't have even known where to begin.   Feel free to try it out and maybe/hopefully you find a flaw or something. I wouldn't be surprised if there is something odd in there. Cheers   ... View more

I've been testing the custom application and trying to figure out what is causing it to not work anymore. My knowledge of custom App-ID's is very limited so if there is a mistake within the application please apologize and let me know. For now I have adjusted the custom App-ID and got it to work (i was testing it out by blocking anything matching that App-ID) and checking if all the CRL URL's are being blocked now.   So far I got the following results: http://crl.sca1b.amazontrust.com/sca1b.crl > working OK http://crl.quovadisglobal.com/hydsslg2.crl > working OK http://cdp.geotrust.com/GeoTrustRSACA2018.crl > working OK http://cdp.geotrust.com/GeoTrustRSACA2018.crl > working OK http://crl3.digicert.com/ssca-sha2-g6.crl > working OK http://crl4.digicert.com/ssca-sha2-g6.crl > working OK http://crl.pki.goog/GTS1O1core.crl > working OK http://crl.godaddy.com/gdig2s1-1878.crl > working OK http://crl3.digicert.com/sha2-ev-server-g2.crl > working OK http://crl4.digicert.com/sha2-ev-server-g2.crl > working OK http://mscrl.microsoft.com/pki/mscorp/crl/Microsoft%20IT%20TLS%20CA%205.crl > working OK > application/octet-stream http://crl.swisssign.net/EEFD46CAF7275E91BC5AB6E787CD0AFA550A2642 > not working yet http://crl.swisssign.net/E7F1E7FD2E53AD11E5811A57A4738F127D98C8AE > not working yet   Now I only need to know how to upload a file and i'll gladly share the app ... View more

Hi Everyone   I'm new to the topic of custom App-IDs, i tried this custom App-ID. but when accessing these CRL urls then it never matches this rule. It is either incomplete or web-browsing. I am running 9.1.3 currently. Has anyone this custom App-ID still running and working?   Thanks for any help and best regards Alex ... View more