Solved

Block internet access to few users in SSG5

Posted on 2009-07-07
28
1,877 Views
Last Modified: 2013-12-04
How to block internet access to few users in SSG5

Please help.
0
Comment
Question by:-MAS
  • 12
  • 8
  • 3
28 Comments
 
LVL 18

Expert Comment

by:deimark
ID: 24800976
What types of users are you looking to block and to what resource?

I am afraid that blocking individual users from access to resources, ie policy rules to deny them access, are not possible.  However, if these users have the same IP address assigned all the time, then you can block by IP address.

0
 
LVL 24

Author Comment

by:-MAS
ID: 24801035
these users are not allowed to browse. they should use only internal resources.
0
 
LVL 24

Author Comment

by:-MAS
ID: 24801041
few are static IP and few are dynamic IP.
0
 
LVL 18

Expert Comment

by:deimark
ID: 24801074
As above, we cannot block users form browsing I'm afraid, thats the job of a decent web proxy.

But also as above, you can block via IP for the static IP users.
0
 
LVL 24

Author Comment

by:-MAS
ID: 24801148
OK fine. I can make it static IP.
 Is it possible to allow few sites like yahoo mail (not messenger), msn messenger, gmail, for these IPs.

Thanks
MAS
0
 
LVL 24

Author Comment

by:-MAS
ID: 24801160
I have web filtering enabled in the firewall.
0
 
LVL 18

Expert Comment

by:deimark
ID: 24801407
Yup, if you have web filtering, you can create a specific profile for the sites you want to allow and deny and then apply it in a security policy applied to the specific IPs you want,

Have a look at www.juniper.net/techpubs, drill down into screenos docs and then download the relevant docs for the UTM functions.  These will describe the process much better than I can.

DM
0
 
LVL 24

Author Comment

by:-MAS
ID: 24901564
I enabled the webfiltering for one IP. even after peer to peer is still working.
Can you please guide me how to add these in the web filtering option.

0
 
LVL 18

Expert Comment

by:deimark
ID: 24901931
Can you tell us exactly what you mean with enabled webfiltering and peer to peer?  I think I have misunderstood you.

An extract of your config will do here bud.

Thanks
0
 
LVL 24

Author Comment

by:-MAS
ID: 24902020
I want to block all IM software and downloads
0
 
LVL 18

Expert Comment

by:deimark
ID: 24902074
Then web filtering is not what you need bud.

Web filtering will allow you to set policies to allow or deny user access to specified websites, not IM and peer to peer.

BLocking IM and P2P is normally best done by an IDP device that can detect any dynamic port changes etc and then compensate, however, we can get around this by the following:

1.  Ensure you have DNS set on your firewall
2.  Add address book entries in the untrust zone for all the IM servers you want to block, ie MSN, yahoo etc.  Use the DNS names (which is why we need 1)
3.  Add all those addresses to a an address group
4.  Specify a security rule from trust to untrust any <group at 3> any deny

If this blocks the access to the IM servers then thus downloading files is also blocked.

Does this help?
0
Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

 
LVL 24

Author Comment

by:-MAS
ID: 24902810
I couldn't add address book entries as I don't know how to do that.
Please help
0
 
LVL 18

Expert Comment

by:deimark
ID: 24902869
www.juniper.net/techpubs

Download the docs for screenos version you are using.  They will explain a lot better than I can as well as answer loads of other questions you may have.
0
 
LVL 24

Author Comment

by:-MAS
ID: 24912265
I added the IP address and name and assigned to a new group. even then it is working fine.
I mean yahoo.
0
 
LVL 18

Expert Comment

by:deimark
ID: 24912305
Copy the config extract for the addresses and policy please

Just the commands with "sat address....." and set policy....." for the related objects and rules.
0
 
LVL 24

Author Comment

by:-MAS
ID: 24912306
Is there any other way I can block it?
0
 
LVL 24

Author Comment

by:-MAS
ID: 24912323
set address "Trust" "192.168.0.12/32" 192.168.0.12 255.255.255.255
set address "Trust" "192.168.0.38/32" 192.168.0.38 255.255.255.255
set address "Trust" "192.168.0.4/32" 192.168.0.4 255.255.255.255
set address "Untrust" "MSN IP" 207.68.172.237 255.255.255.255
set address "Untrust" "MSN IP2" 64.4.15.61 255.255.255.255
set address "Untrust" "MSN messenger" messenger.msn.com
set address "Untrust" "YAHOO" messenger.yahoo.com
set address "Untrust" "YAHOO IP" 68.142.230.204 255.255.255.255
set address "Untrust" "YAHOO IP10" 76.13.218.11 255.255.255.255
set address "Untrust" "YAHOO IP11" 68.142.233.76 255.255.255.255
set address "Untrust" "YAHOO IP12" 68.142.233.147 255.255.255.255
set address "Untrust" "YAHOO IP13" 68.142.233.122 255.255.255.255
set address "Untrust" "YAHOO IP14" 76.13.222.11 255.255.255.255
set address "Untrust" "YAHOO IP15" 76.13.222.11 255.255.255.255
set address "Untrust" "YAHOO IP16" 68.180.216.31 255.255.255.255
set address "Untrust" "YAHOO IP2" 76.13.15.30 255.255.255.255
set address "Untrust" "YAHOO IP3" 68.142.231.252 255.255.255.255
set address "Untrust" "YAHOO IP4" 76.13.15.56 255.255.255.255
set address "Untrust" "YAHOO IP5" 68.180.216.31 255.255.255.255
set address "Untrust" "YAHOO IP6" 66.196.106.31 255.255.255.255
set address "Untrust" "YAHOO IP7" 76.13.15.55 255.255.255.255
set address "Untrust" "YAHOO IP8" 69.147.112.160 255.255.255.255
set address "Untrust" "YAHOO IP9" 66.196.124.67 255.255.255.255
set group address "Untrust" "Block Group"
set group address "Untrust" "Block Group" add "MSN IP"
set group address "Untrust" "Block Group" add "MSN IP2"
set group address "Untrust" "Block Group" add "MSN messenger"
set group address "Untrust" "Block Group" add "YAHOO"
set group address "Untrust" "Block Group" add "YAHOO IP"
set group address "Untrust" "Block Group" add "YAHOO IP10"
set group address "Untrust" "Block Group" add "YAHOO IP11"
set group address "Untrust" "Block Group" add "YAHOO IP12"
set group address "Untrust" "Block Group" add "YAHOO IP13"
set group address "Untrust" "Block Group" add "YAHOO IP14"
set group address "Untrust" "Block Group" add "YAHOO IP15"
set group address "Untrust" "Block Group" add "YAHOO IP16"
set group address "Untrust" "Block Group" add "YAHOO IP2"
set group address "Untrust" "Block Group" add "YAHOO IP3"
set group address "Untrust" "Block Group" add "YAHOO IP4"
set group address "Untrust" "Block Group" add "YAHOO IP5"
set group address "Untrust" "Block Group" add "YAHOO IP6"
set group address "Untrust" "Block Group" add "YAHOO IP7"
set group address "Untrust" "Block Group" add "YAHOO IP8"
set group address "Untrust" "Block Group" add "YAHOO IP9"
0
 
LVL 18

Expert Comment

by:deimark
ID: 24952868
Can you send us the extract for the policies as well please?
0
 
LVL 32

Expert Comment

by:dpk_wal
ID: 24954314
Generally if you wish to allow access to few sites and block access to other websites, then you would configure policies as below:

set policy id x from trust to untrust internal-ip external-ip HTTP allow log
set policy id x+1 from trust to untrust internal-ip any HTTP deny log

Please note in above policies, internal-ip is the address book entry you have added for the internal hosts; external-ip is the address book entry you have added for the external hosts; x is any valid number, x+1 means that this policy would be evaluated after policy with id x is evaluated.

If you wish to block all outbound traffic irrespective if it web traffic or not, you would configure policy with id x+1 as below instead:
set policy id x+1 from trust to untrust internal-ip any any deny log

Thank you.
0
 
LVL 24

Author Comment

by:-MAS
ID: 24958152
see the complete configuration.
Config.txt
0
 
LVL 32

Expert Comment

by:dpk_wal
ID: 24995844
As stated in earlier comment; please use ANY service instead of specific service(s) to deny all outbound traffic; in the config, with policy id 4 you are not blocking HTTP access of machine with IP 192.168.0.12 to the Block Group.

Please elaborate if you wish to block access to few websites (using HTTP) or block complete access on all ports protocol. If you have a smaller set of sites to which access should be allowed/denied then the rules would depend on the requirement.

Please update.

Thank you.
0
 
LVL 24

Author Comment

by:-MAS
ID: 24997822
all messengers and peer to peer  to be blocked (e.g.Yahoo msg, MSN msg, googletalk, emule, youtube download...
and that even not for all users in the company, only particular IPs

Thanks
MAS
0
 
LVL 32

Accepted Solution

by:
dpk_wal earned 500 total points
ID: 24998219
I think you would be better off to allow all HTTP/FTP/SMTP/HTTPS/DNS access to IP 192.168.0.12 and block everything else. If there are more business related protocols which need to be allowed; for eg, pop, voice protocols other; please allow them as well.

Allowing few and blocking everything else would be a better approach in this case.

Please let know if you need exact CLIs.

Thank you.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Join & Write a Comment

Article by: btan
The intent is not to repeat what many has know about Ransomware but more to join its dots of what is it, who are the victims, why it exists, when and how we respond on infection. Lastly, sum up in a glance to share such information with more to help…
Container Orchestration platforms empower organizations to scale their apps at an exceptional rate. This is the reason numerous innovation-driven companies are moving apps to an appropriated datacenter wide platform that empowers them to scale at a …
This video explains how to create simple products associated to Magento configurable product and offers fast way of their generation with Store Manager for Magento tool.
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now