Block internet access to few users in SSG5

How to block internet access to few users in SSG5

Please help.
LVL 31
MAS (MVE)EE Solution Guide - Technical Dept HeadAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

deimarkCommented:
What types of users are you looking to block and to what resource?

I am afraid that blocking individual users from access to resources, ie policy rules to deny them access, are not possible.  However, if these users have the same IP address assigned all the time, then you can block by IP address.

0
MAS (MVE)EE Solution Guide - Technical Dept HeadAuthor Commented:
these users are not allowed to browse. they should use only internal resources.
0
MAS (MVE)EE Solution Guide - Technical Dept HeadAuthor Commented:
few are static IP and few are dynamic IP.
0
Newly released Acronis True Image 2019

In announcing the release of the 15th Anniversary Edition of Acronis True Image 2019, the company revealed that its artificial intelligence-based anti-ransomware technology – stopped more than 200,000 ransomware attacks on 150,000 customers last year.

deimarkCommented:
As above, we cannot block users form browsing I'm afraid, thats the job of a decent web proxy.

But also as above, you can block via IP for the static IP users.
0
MAS (MVE)EE Solution Guide - Technical Dept HeadAuthor Commented:
OK fine. I can make it static IP.
 Is it possible to allow few sites like yahoo mail (not messenger), msn messenger, gmail, for these IPs.

Thanks
MAS
0
MAS (MVE)EE Solution Guide - Technical Dept HeadAuthor Commented:
I have web filtering enabled in the firewall.
0
deimarkCommented:
Yup, if you have web filtering, you can create a specific profile for the sites you want to allow and deny and then apply it in a security policy applied to the specific IPs you want,

Have a look at www.juniper.net/techpubs, drill down into screenos docs and then download the relevant docs for the UTM functions.  These will describe the process much better than I can.

DM
0
MAS (MVE)EE Solution Guide - Technical Dept HeadAuthor Commented:
I enabled the webfiltering for one IP. even after peer to peer is still working.
Can you please guide me how to add these in the web filtering option.

0
deimarkCommented:
Can you tell us exactly what you mean with enabled webfiltering and peer to peer?  I think I have misunderstood you.

An extract of your config will do here bud.

Thanks
0
MAS (MVE)EE Solution Guide - Technical Dept HeadAuthor Commented:
I want to block all IM software and downloads
0
deimarkCommented:
Then web filtering is not what you need bud.

Web filtering will allow you to set policies to allow or deny user access to specified websites, not IM and peer to peer.

BLocking IM and P2P is normally best done by an IDP device that can detect any dynamic port changes etc and then compensate, however, we can get around this by the following:

1.  Ensure you have DNS set on your firewall
2.  Add address book entries in the untrust zone for all the IM servers you want to block, ie MSN, yahoo etc.  Use the DNS names (which is why we need 1)
3.  Add all those addresses to a an address group
4.  Specify a security rule from trust to untrust any <group at 3> any deny

If this blocks the access to the IM servers then thus downloading files is also blocked.

Does this help?
0
MAS (MVE)EE Solution Guide - Technical Dept HeadAuthor Commented:
I couldn't add address book entries as I don't know how to do that.
Please help
0
deimarkCommented:
www.juniper.net/techpubs

Download the docs for screenos version you are using.  They will explain a lot better than I can as well as answer loads of other questions you may have.
0
MAS (MVE)EE Solution Guide - Technical Dept HeadAuthor Commented:
I added the IP address and name and assigned to a new group. even then it is working fine.
I mean yahoo.
0
deimarkCommented:
Copy the config extract for the addresses and policy please

Just the commands with "sat address....." and set policy....." for the related objects and rules.
0
MAS (MVE)EE Solution Guide - Technical Dept HeadAuthor Commented:
Is there any other way I can block it?
0
MAS (MVE)EE Solution Guide - Technical Dept HeadAuthor Commented:
set address "Trust" "192.168.0.12/32" 192.168.0.12 255.255.255.255
set address "Trust" "192.168.0.38/32" 192.168.0.38 255.255.255.255
set address "Trust" "192.168.0.4/32" 192.168.0.4 255.255.255.255
set address "Untrust" "MSN IP" 207.68.172.237 255.255.255.255
set address "Untrust" "MSN IP2" 64.4.15.61 255.255.255.255
set address "Untrust" "MSN messenger" messenger.msn.com
set address "Untrust" "YAHOO" messenger.yahoo.com
set address "Untrust" "YAHOO IP" 68.142.230.204 255.255.255.255
set address "Untrust" "YAHOO IP10" 76.13.218.11 255.255.255.255
set address "Untrust" "YAHOO IP11" 68.142.233.76 255.255.255.255
set address "Untrust" "YAHOO IP12" 68.142.233.147 255.255.255.255
set address "Untrust" "YAHOO IP13" 68.142.233.122 255.255.255.255
set address "Untrust" "YAHOO IP14" 76.13.222.11 255.255.255.255
set address "Untrust" "YAHOO IP15" 76.13.222.11 255.255.255.255
set address "Untrust" "YAHOO IP16" 68.180.216.31 255.255.255.255
set address "Untrust" "YAHOO IP2" 76.13.15.30 255.255.255.255
set address "Untrust" "YAHOO IP3" 68.142.231.252 255.255.255.255
set address "Untrust" "YAHOO IP4" 76.13.15.56 255.255.255.255
set address "Untrust" "YAHOO IP5" 68.180.216.31 255.255.255.255
set address "Untrust" "YAHOO IP6" 66.196.106.31 255.255.255.255
set address "Untrust" "YAHOO IP7" 76.13.15.55 255.255.255.255
set address "Untrust" "YAHOO IP8" 69.147.112.160 255.255.255.255
set address "Untrust" "YAHOO IP9" 66.196.124.67 255.255.255.255
set group address "Untrust" "Block Group"
set group address "Untrust" "Block Group" add "MSN IP"
set group address "Untrust" "Block Group" add "MSN IP2"
set group address "Untrust" "Block Group" add "MSN messenger"
set group address "Untrust" "Block Group" add "YAHOO"
set group address "Untrust" "Block Group" add "YAHOO IP"
set group address "Untrust" "Block Group" add "YAHOO IP10"
set group address "Untrust" "Block Group" add "YAHOO IP11"
set group address "Untrust" "Block Group" add "YAHOO IP12"
set group address "Untrust" "Block Group" add "YAHOO IP13"
set group address "Untrust" "Block Group" add "YAHOO IP14"
set group address "Untrust" "Block Group" add "YAHOO IP15"
set group address "Untrust" "Block Group" add "YAHOO IP16"
set group address "Untrust" "Block Group" add "YAHOO IP2"
set group address "Untrust" "Block Group" add "YAHOO IP3"
set group address "Untrust" "Block Group" add "YAHOO IP4"
set group address "Untrust" "Block Group" add "YAHOO IP5"
set group address "Untrust" "Block Group" add "YAHOO IP6"
set group address "Untrust" "Block Group" add "YAHOO IP7"
set group address "Untrust" "Block Group" add "YAHOO IP8"
set group address "Untrust" "Block Group" add "YAHOO IP9"
0
deimarkCommented:
Can you send us the extract for the policies as well please?
0
dpk_walCommented:
Generally if you wish to allow access to few sites and block access to other websites, then you would configure policies as below:

set policy id x from trust to untrust internal-ip external-ip HTTP allow log
set policy id x+1 from trust to untrust internal-ip any HTTP deny log

Please note in above policies, internal-ip is the address book entry you have added for the internal hosts; external-ip is the address book entry you have added for the external hosts; x is any valid number, x+1 means that this policy would be evaluated after policy with id x is evaluated.

If you wish to block all outbound traffic irrespective if it web traffic or not, you would configure policy with id x+1 as below instead:
set policy id x+1 from trust to untrust internal-ip any any deny log

Thank you.
0
MAS (MVE)EE Solution Guide - Technical Dept HeadAuthor Commented:
see the complete configuration.
Config.txt
0
dpk_walCommented:
As stated in earlier comment; please use ANY service instead of specific service(s) to deny all outbound traffic; in the config, with policy id 4 you are not blocking HTTP access of machine with IP 192.168.0.12 to the Block Group.

Please elaborate if you wish to block access to few websites (using HTTP) or block complete access on all ports protocol. If you have a smaller set of sites to which access should be allowed/denied then the rules would depend on the requirement.

Please update.

Thank you.
0
MAS (MVE)EE Solution Guide - Technical Dept HeadAuthor Commented:
all messengers and peer to peer  to be blocked (e.g.Yahoo msg, MSN msg, googletalk, emule, youtube download...
and that even not for all users in the company, only particular IPs

Thanks
MAS
0
dpk_walCommented:
I think you would be better off to allow all HTTP/FTP/SMTP/HTTPS/DNS access to IP 192.168.0.12 and block everything else. If there are more business related protocols which need to be allowed; for eg, pop, voice protocols other; please allow them as well.

Allowing few and blocking everything else would be a better approach in this case.

Please let know if you need exact CLIs.

Thank you.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
OS Security

From novice to tech pro — start learning today.