Need Help

[MRJUL]

How do I block the website like

http://www.yahoo.com

I am using NS5GT. I tried all kind of port and configure but still I can go to yahoo website.

Thanks,
Richard

 

[Packet7]

Hello,

If you're using ScreenOS5, you can enter it in as a Malicious URL. I would simply create a summy DNS record. That is if your pointing to an internal DNS server.

Rgds,

John

 

[MRJUL]

Thank for reply, what do you mean pointing to internal DNS? I tried to put malicous URL but still I can go to yahoo website. any ports number that I have fill it?


Thanks,
Richard

 

[Packet7]

Hello,

Run an IPCONFIG on your PC. Is the IP a Public or Private address. If it's Private, go to the DNS server and create a yahoo.com zone. You can either leave it blank or create an "A" record that points to 127.0.0.1.

Rgds,

John

 

[MRJUL]

I did create the zone and what ID, Pattern and Length should I put?
Thanks,
Richard

 

[Packet7]

Are you creating the zone in DNS or your Netscreen? This is a fix that leaves out the Netscreen and should be done on your DNS server.

Rgds,

John

 

[MRJUL]

Yes DNS server is done on netscreen,But When you said "You can either leave it blank or create an "A" record that points to 127.0.0.1." where I should create this?
I did create under network and Zone but still can't filter yahoo website.

Thanks,
Richard

 

[MRJUL]

Hello John,

I got everything setup including the policies, but Still Couldn't block the website. I put DNS 0.0.0.0 and 2nd DNS 0.0.0.0 , what suppose to put?
btw, if I put the block website policies first and 2nd for any, everything don't go any website.

Thanks,
Richard

 

[Packet7]

Hey,

I meant you could use a local DNS entry (local on your LAN) with a fake entry. Not on the Netscreen. Are we on different pages? Let me know.

Rgds,

John

 

[MRJUL]

Hello John,

Where should I put the local DNS? can you specify?I put on netscreen 192.168.1.2 and 2nd DNS I put 192.168.1.1
then I create the group, then I make from trust to untrust.
but still... did I do something wrong?
Thanks for helping

Richard

 

[MRJUL]

Hi John,

It works like charm,
Thanks,
Juli

 

[MRJUL]

Hi John,

How Do I change the error message? I appear "Error! Your firewall can't talk to the URL Screening Server. Please contact your system administrator for help. "
I did change on the URL Filtering but the Message don't change.

Thanks,
Richard

 

[Packet7]

Hey,

I think you might be able to verify that the message has been changed in the Config. Save it locally and edit it in a Text Editor. Not really sure, but that's what I would try.

Rgds,

John

 

[MRJUL]

Hi,

I was wondering,Can I block from 192.168.2.1 to 192.168.2.199?? How do I unblock the ip address from 192.168.2.200 to 192.168.2.244?

Thanks,
Richard

 

[Packet7]

Hey,

Are you looking to block an internal range 192.168.2.1-.199 to the internet? And permit 192.168.200-244 to the internet?

Range of IPs aren't supported on the Netscreen for Policy use. You can use subnets though, but I'm guessing you're using 192.168.2.x/24. All hosts on the same subnet...

You can create a number of local Hosts (using IP addresses) in the Trust Zone, and then define a group for policy. But, as you already guessed, this is a lot of objects!

I would either use a VLAN at layer 2 on your LAN or create another subnet internally for use with Policy. Each of these options would require additional overhead though.

Hope this helps.

Rgds,

John

 

[MRJUL]

John,

Yes I think a lot of object if I put this way, Do you know if you can create the user name and password on the advance policy?
How do I create the authentication user and password on the advance policy?
I do check the authentication on the advance policy and I go to the website that I block
and popup the user name and password

Thanks,
Richard

 

[Packet7]

Hey Richard,

I'm not sure I follow? Do you want to use a Auth Web Page to permit Internet Access? Let me know and we'll see what we can do.


Rgds,

John

 

[MRJUL]

John,

Yes I think I am going to use Auth web page permit. I config the authentication on advance policy, it's popup the use name and password. but after I put everything user and password it goes well to the website but the problem is not every time I go to that site asking me the user and password. that's wired.

Thanks,
Richard

 

[Packet7]

Hello,

It's my understanding that once you Auth, all Internet requests after that should be permitted.

Are you saying that this functionality breaks over time? Could be a time-out issue on your Auth settings. What do you think?

Rgds,

John

 

[MRJUL]

Yes I need to setup the time, the default time is 10 mins
but I still couldn't figure out the msn messenger. it still allow me to online msn messanger.

Thanks,
Richard