Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
G_W_Albrecht
Legend Legend
Legend

URLF / APCL Whitelisting

A customer wanted to allow his clients access to all sites needed by whitelisting (R77.30). He uses URLF / APCL blade, but no https inspection, so all he can do is let the blade categorize https sites. But he does not want to Allow any URLF Categories!

Using Custom Categories for overriding URLF category to create exception does not work, because Custom Categories only can be used in URLF / APCL rulebase and is not available for "Overriding URLF category" that only shows the pre-defined categories. Otherwise, it would be possible to first create a new category and then overide the URLF categorization with this category for the sites to be whitelisted. Then he could allow the sites by allowing the new category (=RFE).

So he had to follow this procedure for site exceptions suggested by CP:

1. Create one custom application with all the URLs that you need allow or different custom applications for each needed URL

2. Add the created application to "allow" rule on top of rule base

3. Add "DNS protocol" and "SSL protocol" services to the same rule (we have to allow them in case a custom application is used).

4. Install policy.

This solution will work even if HTTPS inspection is disabled.

CCSE / CCTE / CTPS / CCME / CCSM Elite / SMB Specialist
12 Replies
Vladimir
Champion
Champion

Guenther,

Can you expand on the "3 different custom applications for each URL"?

Thank you,

Vladimir

0 Kudos
Marco_Valenti
Advisor

why not using a regex for those site and assign to a custom categorie and put the categorie in an allow rule at the top? probably I am missing something

0 Kudos
G_W_Albrecht
Legend Legend
Legend

Hi,

call it a typo 😉 Here, customer has two URLs that could have been whitelisted by IP address and one that had to use DNS resolving (collaboration site). That gave three...

CCSE / CCTE / CTPS / CCME / CCSM Elite / SMB Specialist
0 Kudos
G_W_Albrecht
Legend Legend
Legend

regex is good if you are 😉 I have seen strange side effects with regex created by people without very much experience and in analysis learned that pattern matching is not really that easy. So this seems much more appropriate as the customer can add more URLs if needed without risk of bad regex .

CCSE / CCTE / CTPS / CCME / CCSM Elite / SMB Specialist
Hiep_Bui
Participant

Hello Günther,
I am searching for a solution of allowing specific youtube videos but blocking youtube and found this post.
Can you please explain in more details step 3 - "Add "DNS protocol" and "SSL protocol" apps to the same rule"?
My current situation: Mgmt & gateway in R80.20, I have a rule with:
- source: some IP addresses
- destination: any
- app & services: a list of youtube videos that I want to allow.

When I tried to go to a youtube video in the allowed list, it doesnot match with my rule but blocked by the next rule that blocks Youtube.
thanks,
Hiep.

0 Kudos
G_W_Albrecht
Legend Legend
Legend

Thank you, i have corrected that to services  !

CCSE / CCTE / CTPS / CCME / CCSM Elite / SMB Specialist
0 Kudos
Hiep_Bui
Participant

Hi Gunther,

I understood that you meant "services". I was actually asking you how the rules looked like.

(my current issue is I am not able to allow some specific youtube videos but block all others; or similarly, block a category of a site but allow other categories of the same site, for example: block https://www.bbc.com/sport  but allow https://www.bbc.com as well as other categories of bbc.com)

Thanks,

Hiep.

0 Kudos
G_W_Albrecht
Legend Legend
Legend

I would suggest to create custom apps for the URLs and add them to the rulebase, but this will need to have https inspection enabled - else it will be impossible to block  https://www.bbc.com/sportbut not  https://www.bbc.com.

CCSE / CCTE / CTPS / CCME / CCSM Elite / SMB Specialist
0 Kudos
RKinsp
Contributor

Hello! Sorry to bring up such an old topic, but I am curious as to how this is working. In theory, without HTTPS inspection, the only time the URL is "seen" is during DNS resolution. Is this getting blocked at the DNS resolutions stage, much like a DNS query filter would work? 

I ask because I have a similar demand to block specific URLs without HTTPS inspection, however with the additional challenge that some domains user the same wildcard certificate and have the same destination IP.

 

Thanks in advance,

RK

0 Kudos
Timothy_Hall
Legend Legend
Legend

No the site name (SNI) is included in the Client Hello sent by the browser and that happens in the clear.  There is also a site name (subject) as part of the web server's certificate which is also sent before encryption starts.  However if these values are not truly indicative of where the user will end up, once encryption starts there is no way to see what happens after that without HTTPS Inspection.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos
RKinsp
Contributor

Thanks Timothy! BTW, big fan of your book.

In this case, if the SNI will does not help, is there any way to block the DNS query?

I realize it does not provide security, since a user could simply type the direct IP, but this is more of a control issue than security.

I figured the Custom Application Tool would be a way however I can no longer find the download for it (link in the SK is dead). I'm guessing it has been discontinued.

 

0 Kudos
Timothy_Hall
Legend Legend
Legend

You could just define a domain object matching the undesirable site then use it in a Drop rule, however this wouldn't affect the DNS lookup traffic: sk120633: Domain Objects in R8x.  Although I still am hesitant about recommending the use of domain objects due to some bad prior experiences, even though domain objects were revamped in R80.

From the DNS end you could define a custom Threat Prevention Indicator for the Anti-virus or Anti-bot blades to match that site name, and block it that way.  If you do the Indicator for Anti-bot, I'm not completely sure if the offender would get caught by the Malware DNS trap in that instance or not.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events