Skip to main content
caimongs
caimongs
New Member
December 28, 2015
Question

BLOCK specific IP/PC/User

  • December 28, 2015
  • 3 replies
  • 15794 views

Hi all.

I got a 90D device. I want to block some User in my domain access to internet.

I try to set up but it doesn't work. Anyone help.

 

When i set up WEB FILTER, it effect to all network, all user. But i just want it effect to some user/PC/IP only. Is it possible? 

 

I read someone talk about SINGLE SIGN ON function.

I already set up SINGLE SIGN ON in my AD and already connected.

But when i create policy, it doesn't work. I don't know what wrong, did i wrong in setting up.

 

Explain for image

policy 1: All user can access to All resource

policy 2: User in group " FSSO BLOCK GROUP" can NOT access to  All resource.

( i tried move policy 2 up but nothing change)

 

Please contact me through this forum or by email nam.lt@outlook.com

 

Thank you so much 

    3 replies

    bobm
    bobm
    New Member
    January 12, 2016

    Hi,

    Don't know if anyone has contacted you privately, but it looks like you have your Policy order backwards. Try placing the Deny policy above the Allow policy.  When a packet hits the FG, it will be processed via the first policy that applies to it.  Since the Allow is for "all" it is processed there and never hits the second one.

    yest
    yest
    New Member
    April 9, 2016

    How do I block specific "blogger.com"

    We have the google FQDN's opened per their suggestion ( https://support.google.com/a/answer/2589954?hl=en ) and ( https://support.google.com/drive/answer/6163291 )   the kids have discovered a number of gaming sites on google homepages, all seem to be named "my games

    " i.e. http://mygameus.blogspot.com http://mygameus.blogspot.com/2016/03/Barney.html [link=http://mygameus.blogspot.com/2016/03/Jet-Pack-Monkey.html] http://mygameus.blogspot....3/Jet-Pack-Monkey.html[/link] The problem is that blocking google by address doesn't seem to work as every request seems to use a different one, and I don't know why but I don't seem to be able to block by name.   I put in a simple IPV4 policy, source = any,  Destination = "http://mygameus.blogspot.com/2016/03/Crosstown-Craze.html",  block and it doesn't work.  because it is a block there is no SSL inspection or anything like that....   When I look at the log there is nothing that says "http://mygameus.blogspot.com/2016/03/Crosstown-Craze.html" just "encrypted-tbn1.gstatic.com" but I don't want to block all of google, just the few sites.   Can anyone help?

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    April 9, 2016

    You could use Application Control to block the whole category instead of just one URL. Create an AC sensor, enable category "Gaming" and apply that to the policy 'internal' -> 'wan'. Works quite well IME.

    Terms & ConditionsAccessibility statement
    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.