Blocking proxy tunneling apps like Psiphon

[RohiBech]

Hi ,

We're having a hard time blocking Psiphon.

We blocked "proxy" in app control and blocked "proxy avoidance" in web filtering .

In the logs we see that it blocks the Application but it creates an HTTP/HTTPS Proxy connection aswell .

If we add Full SSL inspection with all ports checked , the application gets fully blocked , but this affects alot of other websites due to the full SSL inspection.

Is there a way to block this application without affecting normal browsing.

This is for a public network.

Thanks ,

Rohit

[lhidalgo020480]

We have open wireless network and is not possible to enable the full inspection in these network, is possible the application module can detect this new proxy application for block without apply deep ssl inspection?

More information:
https://www.psiphon3.com/psiphon3.exe

Best Regards

Luis Hidalgo

[lhidalgo020480]

This file contain the technical information about psiphon3

[DaviWang1]

Please either send a request to ips@fortinet.com, or file mantis bug in "IPS Engine & Sigs" to request Psiphon block without SSL deep inspection. IPS analyst team should be able to look into the feasibility.

[lhidalgo020480]

I have created a support ticket 1930377, but dont't have response, this new proxy application is encrypted for this reason is not possible to block, i must to deploy the ssl inspection for block this app.

The idea for open network and secure is not possible.

Best Regards

Luis Hidalgo

[lhidalgo020480]

Dear Guys:

IPS Fortinet Team is great!

Thanks a lot, i going to begin from zero (new installation) and works very well!!!... Thanks a lot!!!

 In new signature versions will remain IPS? It would be advisable to be able to send this update to show once again the impressive speed and capacity development that IPS Fortinet Team and you have.

Best Regards

Luis Hidalgo