topic Re: How to block path wise URL. in General Topics

How to block path wise URL.

maxtaan — Mon, 19 Feb 2024 15:56:46 GMT

Want to block this type of url. Already follow the custom URL block procedure, but the URL is still accessible.
We want to block
hxxps://github.com/agbusi/keteorie/bojb/gain/yrsfaction_Rkoj_jpg.zip
this type of URL. Where hxxps=https.

Re: How to block path wise URL.

the_rock — Mon, 19 Feb 2024 15:17:57 GMT

Just add *github* as custom app site object and use that in the policy rule. I always do so in app/url ordered layer.

Best,

Andy

Re: How to block path wise URL.

maxtaan — Mon, 19 Feb 2024 15:55:33 GMT

Hello @the_rock

I want to block the whole path only, not the full application/site. Is it possible?

Thanks

Re: How to block path wise URL.

delToro1 — Mon, 19 Feb 2024 16:48:24 GMT

Hello mate,

I think that if you want to block this specific URL, you need inspect the https traffic to know the HTTP URI. As @the_rock said, the other way is blocking the domain github, that is possible because the TLS SNI header is not encrypted.

BR.

Re: How to block path wise URL.

maxtaan — Mon, 19 Feb 2024 17:05:14 GMT

Thanks Mate. So, if i want to block specific URLs then i must need HTTPS inspection blade enabled?

Re: How to block path wise URL.

the_rock — Mon, 19 Feb 2024 17:46:48 GMT

correct!

Re: How to block path wise URL.

the_rock — Mon, 19 Feb 2024 19:12:14 GMT

Thats right, so you definitely need https inspection feature turned on.

Best,

Andy

Re: How to block path wise URL.

maxtaan — Tue, 20 Feb 2024 05:49:48 GMT

Hi @the_rock

Thanks for your response. Is there any SK/Document available regarding this?

Re: How to block path wise URL.

the_rock — Tue, 20 Feb 2024 13:22:14 GMT

I cnt think of any off the top of my head, but will see if I can find it. Ping me offline if you need more help, I have really good https inspetion lab...well, 2 as a matter of fact, but 1 I always use it.

Best,

Andy

Re: How to block path wise URL.

the_rock — Tue, 20 Feb 2024 18:24:01 GMT

Best I found is below.

Andy

https://support.checkpoint.com/results/sk/sk108202

https://support.checkpoint.com/results/sk/sk65123