topic Re: Need to block access to Microsoft Copilot in Firewall and Security Management

Need to block access to Microsoft Copilot

AttiqRahman786 — Wed, 28 Aug 2024 08:46:03 GMT

Hello All,

I have blocked ChatGPT and Google Gemini, using their respective apps in App&URL policy. the access to these two is blocked.

but i cannot block Microsoft copilot uisng the "Microsoft Copilot" app.

I have also tried creating a custom app, using chat.bing.com which is forwarded to bing.com/chat, without any luck. Customer do not want to get blocked for bing.com, but only the chat/AI should be blocked.

Also tried blocking bing.com/chat (chat.bing.com gets forwarded to this) and used Regex as well, but for some reason, Microsoft copilot is not getting blocked.

even tried to manually override the bing.com/chat category.

SMS and Gateways on R81.10 JHA take 156.

Any help will be much appreciated.

Thanks

Re: Need to block access to Microsoft Copilot

Chris_Atkinson — Wed, 28 Aug 2024 10:51:25 GMT

Have you tried the "Artificial Intelligence" category or is there a reason that you're attempting to be more specific?

Re: Need to block access to Microsoft Copilot

AttiqRahman786 — Wed, 28 Aug 2024 10:55:23 GMT

Yes i did try that first. it blocks lots of internal apps as well that are required. so decided to block only the specific ones.

Funny thing is Microsoft copilot was not blocked even when using the whole AI category.

Re: Need to block access to Microsoft Copilot

Tal_Paz-Fridman — Wed, 28 Aug 2024 11:02:12 GMT

You can add the specific application to the rule:

Re: Need to block access to Microsoft Copilot

AttiqRahman786 — Wed, 28 Aug 2024 11:11:56 GMT

Yes i have done the same thing. ChatGPT and Google Gemini are being blocked but not Microsoft Copilot.

Please see the image attached.

Re: Need to block access to Microsoft Copilot

Tal_Paz-Fridman — Wed, 28 Aug 2024 11:16:04 GMT

I see. I will ask relevant teams to look at this.

Re: Need to block access to Microsoft Copilot

AttiqRahman786 — Wed, 28 Aug 2024 13:38:45 GMT

Thanks a lot.

Re: Need to block access to Microsoft Copilot

PhoneBoy — Wed, 28 Aug 2024 15:44:05 GMT

If you haven't already, I suggest opening a TAC case: https://help.checkpoint.com

Re: Need to block access to Microsoft Copilot

the_rock — Wed, 28 Aug 2024 18:24:32 GMT

I did exactly what @Tal_Paz-Fridman suggested, worked fine. I also made sure its inspected by https policy and verified copilot.microsoft.com is blocked as well.

Andy

Re: Need to block access to Microsoft Copilot

AttiqRahman786 — Wed, 28 Aug 2024 18:49:31 GMT

That could be the thing. we have not enabled https inspection, instead using SNI, and its working for other two Apps. not for MS Copilot though.

due to the URL redirection, I guess SNI is not working as expected.

@PhoneBoy what do you think, should raise a TAC case?

Re: Need to block access to Microsoft Copilot

the_rock — Wed, 28 Aug 2024 18:57:48 GMT

That could be the issue, you most likely need ssl inspection turned on, not sure how it can work otherwise.

Andy

Re: Need to block access to Microsoft Copilot

the_rock — Wed, 28 Aug 2024 19:00:33 GMT

Also, check out this post from 2021. I know that was before R81.20, but it has lots of GREAT responses.

Andy

https://community.checkpoint.com/t5/Security-Gateways/Categorize-HTTPS-Websites/m-p/134729/emcs_t/S2h8ZW1haWx8dG9waWNfc3Vic2NyaXB0aW9ufEtXQzJBQUFSS0w3WDNXfDEzNDcyOXxTVUJTQ1JJUFRJT05TfGhL#M20231

Re: Need to block access to Microsoft Copilot

AttiqRahman786 — Wed, 28 Aug 2024 19:35:22 GMT

That was a good read. Thanks a lot.

Re: Need to block access to Microsoft Copilot

the_rock — Wed, 28 Aug 2024 21:02:49 GMT

No problem. @_Val_ explained it really well in one of his posts there.

Andy

Re: Need to block access to Microsoft Copilot

PhoneBoy — Wed, 28 Aug 2024 23:26:49 GMT

To block a specific URL (e.g. bing.com/chat), you definitely will need HTTPS Inspection.
Possible that is required for the App Control signature to work.

Re: Need to block access to Microsoft Copilot

AttiqRahman786 — Thu, 29 Aug 2024 09:47:49 GMT

Yes i understand. Thanks a lot.

Re: Need to block access to Microsoft Copilot

the_rock — Thu, 29 Aug 2024 12:00:50 GMT

100% you would need ssl inspection enabled for the app control to fully function, for sure.

Let me try explain it in simple terms, hope it will make sense, but if not, let me know...so with ssl inspection on, fw will act as MITM (man in the middle), intercepting requests between client/server. Without it, yes, you can block pages, BUT, block page will never show up, as there would be nothing for the firewall to inspect/intercept.

Same goes for any app you wish to block.

Andy