Endpoint Protection

Hi All,

 

we have a requirement that is to block google drive,cloud and sheets, and i put them in via the SEP firewall to block only those DNS names, but it seems to be blocking youtube and maps as well,

 

any ideas?

 

What does the Traffic log show as being blocked? You may need to get more granular with the rule or add an allow rule above this one allowing YouTube and maps.

Hi Brian,

checking the traffic log it does not show a block or drop for youtube or maps :|

Do you have the rules set to log?

Hi John,

 

i do now, :| will check again

This is manual work but you could remove all domains and add each back one by one and test it out to see exactly which one is the cause.
 

Sounds good.  Let us know what you find and your solution.

Hi All,

 

all the logs when going to youtube etc, it shows as blocking drive.google.com but when a user reloads the page youtube works, then can navigate to google drive. which i need blocked due to the data leakage issues,

i think is because my SEPM licence expired 2 days ago - does this stop the network host/firewall part of the SEP product?

Nope, expired license won't affect the firewall.

May want to get a support case opened up to look into. A valid support entitlement will be needed though.

Hi Brian,

 

now the block is working; nothing was changed.

from my understanding the sep firewall will check the packets being sent and then see the dns name and block it?

is it possible sep is being overloaded or the severity is not on the right rating?

Please remember the SEP firewall was not designed to be a web filter.  While it can work their have been some strange things that happen when trying to use it this way.  We do have products specifically designed to block websites/domains you could look into.

 

Yes, it checks each packet. I've not seen ay issues with this before. You didn't mention th eexact version this occurred on? The only other thing I can think of is the client didn't have the same policy as what was on the SEPM at the time and once it grabbed the new policy it then worked as expected.

I fully agree with Mr. Brian. Does anyone have a solution for blocking youtube and google maps?

Hi All,

 

sorry for the delay, basically what was happeninig is, if you ping youtube or google it goes via the same google gateway of sorts and it was blocking that, i couldnt find a way around this, and we are using sep 14.0.2415.0200