SRX240 AppFw block message

juniper-srx

I am configuring the AppFw on a SRX240 chassis this works fine to block Facebook or Twitter or whatever application. I also configured a custom block message to redirect a user to a specific web page when the policy is met.

The problem is that this block message does not work with either Facebook or Twitter, the content is blocked (thus the policy must be met?) but the connection times out in stead of redirecting the user to the configured block-message.

When I configure another application like Reuters, it all works flawless. I'm mainly puzzled why this happens and of course it would be excellent if anyone knows how to show the block message or redirect!

As per request my AppFw test config:

application-firewall {
    profile test_block_msg {
        block-message {
            type {
                custom-redirect-url {
                    content http://www.justasite.nl;
                }
            }
        }
    }
    rule-sets test-apfw {
        rule 1 {
            match {
                dynamic-application-group junos:web:social-networking:facebook;
            }
            then {
                deny;
            }
        }
        rule 2 {
            match {
                dynamic-application [ junos:TWITTER junos:TWITTER-UPDATE junos:TWITVID junos:TWITTER-SSL ];
            }
            then {
                deny;
            }
        }
        default-rule {
            permit;
        }
        profile test_block_msg;
    }
}

And my policies:

policies {
    from-zone Inside to-zone Outside {
        policy test-apfw-pol {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                permit {
                    application-services {
                        application-firewall {
                            rule-set test-apfw;
                        }
                    }
                }
            }
        }
        policy in-to-out {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                permit;
            }
        }
    }
    from-zone Outside to-zone Inside {
        policy Outside-to-IIS {
            match {
                source-address IIS_Ext_permitted;
                destination-address IIS_Test;
                application HTTP;
            }
            then {
                permit;
                log {
                    session-init;
                    session-close;
                }
            }
        }
        policy my-ssh {
            match {
                source-address any;
                destination-address any;
                application my-ssh;
            }
            then {
                permit;
            }
        }
        policy dyn-vpn-SECPOL {
            match {
                source-address any;
                destination-address any;
                application any;
            }
            then {
                permit {
                    tunnel {
                        ipsec-vpn SRX100;
                    }
                }
            }
        }
    }
}

Hope this helps.

Best Answer

It looks like the usual problem where HTTP redirect works (Reuters), but HTTPS doesn't (Facebook and Twitter).

To display a "this page is blocked" message when it's a HTTPS connection, you'll need a MITM, because you'll need not to break the TLS handshake (which is happening right now).

Run the test - try connecting to a HTTP site that you've blocked, and then try an HTTPS version of the same site (just make sure it's not a site that redirects from HTTP to HTTPS like Facebook and Twitter do).

Related Topic