How do I block specific "sites.google.com"

Question

We have the google FQDN's opened per their suggestion ( https://support.google.com/a/answer/2589954?hl=en ) and ( https://support.google.com/drive/answer/6163291 )

the kids have discovered a number of gaming sites on google homepages, all seem to be named "unblocked games" i.e.

https://sites.google.com/site/unblockedgames4me

https://sites.google.com/site/unblockedgames77

https://sites.google.com/site/punblockedgames/

The problem is that blocking google by address doesn't seem to work as every request seems to use a different one, and I don't know why but I don't seem to be able to block by name.

I put in a simple IPV4 policy, source = any, Destination = "sites.google.com/site/unblockedgames4me", block

and it doesn't work. because it is a block there is no SSL inspection or anything like that....

When I look at the log there is nothing that says "sites.google.com/site/unblockedgames4me" just "encrypted-tbn1.gstatic.com" but I don't want to block all of google, just the few sites.

Can anyone help?

AlexFeren · Accepted Answer

michellem812 wrote:If I enable Full (deep) inspection, then Google complains about HSTS issues. How did you get past that issue?[size="2"][/size][size="3"]See "config ssl-exempt" below.[/size] FG60C (root) # show firewall ssl-ssh-profile "Deep-inspection with HSTS Exception" config firewall ssl-ssh-profile     edit "Deep-inspection with HSTS Exception"         set comment "Deep inspection!"             config https                 set ports 443             end             config ftps                 set ports 990             end             config imaps                 set ports 993             end             config pop3s                 set ports 995             end             config smtps                 set ports 465             end             config ssl-exempt                 edit 1                     set type address                     set address "*.adobe.com"                 next                 edit 2                     set type address                     set address "android"                 next                 edit 3                     set type address                     set address "apple"                 next                 edit 4                     set type address                     set address "appstore.com"                 next                 edit 5                     set type address                     set address "citrixonline"                 next                 edit 6                     set type address                     set address "dropbox.com"                 next                 edit 7                     set type address                     set address "Gotomeeting"                 next                 edit 8                     set type address                     set address "icloud"                 next                 edit 9                     set type address                     set address "itunes"                 next                 edit 10                     set type address                     set address "skype"                 next                 edit 11                     set type address                     set address "swscan.apple.com"                 next                 edit 12                     set type address                     set address "update.microsoft.com"                 next                 edit 13                     set type address                     set address "HSTS"                 next             end     next end   FG60C (root) # show firewall addrgrp HSTS config firewall addrgrp     edit "HSTS"         set member "wikipedia" "Google"     next end FG60C (root) # show firewall addrgrp Google config firewall addrgrp     edit "Google"         set member "*.google.com.au" "*.google.com"     next end FG60C (root) # show firewall address *.google.com.au config firewall address     edit "*.google.com.au"         set type fqdn         set fqdn "*.google.com.au"     next end  FG60C (root) # show firewall address *.google.com config firewall address     edit "*.google.com"         set type fqdn         set fqdn "*.google.com"     next end

gschmitt · Answer

Don't use a FQDN Object for Webfiltering

Please go to Security Profiles > Webfilter and select your used Webfilter

Check Enable URL Filter and click Create New

Enter your URL, make sure Enable is checked and hit OK and Apply

Make sure the Webfiltering Profile is selected for your internal to wan policy

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded