topic Navigate to System>updates in Network Security

block psiphon application on source fire.

chawkideeb — Tue, 12 Mar 2019 13:02:39 GMT

Dears,

I have a firewall with software source fire.

license : ips + application + url filtering

i blocked everything related to facebook , youtube , some vpn ,etc... and all is okey.

There is an application ( PSIPHON) that users install it on their mobile and on their laptops or PCs .And through this application they can open facebook,youtube,etc...

All users are using it and bypass the Firesight rule.

https://psiphon.ca/en/download.html

this application will open a VPN session through the internet and it is available on android and now as a portable version for windows desktop.

Do you have any idea oe a step-by-step on how to stop the above application?

thanks in advance...

please send me the answer on chawki.dib@bmbgroup.com

Best Regards,

Chawki Dib

Hi Chawki,

yogdhanu — Wed, 22 Jun 2016 07:39:15 GMT

Hi Chawki,

You can try to use the application block on firepower to block proxy application. There is a application detector for Psiphon in there.

You can either try to block that or block the whole category VPN, proxy/anonymiser category itself which blocks the proxy apps.

Rate if helps.

Yogesh

Dear,

chawkideeb — Wed, 22 Jun 2016 07:54:19 GMT

Dear,

Thank you for your quick response.

Can you tell me which starting version of the firesight/firepower the psiphon application is there?

Because I cannot detect it.

My current version is firesight : 5.4.1

ASA 5506-x

Firepower = software not hardware module

So i can do the upgarde and tell you if the above will solve my issue.

Thanks in advance…

Hi

yogdhanu — Wed, 22 Jun 2016 08:00:26 GMT

Please update the VDB to latest. I am running VDB 270 which has this application.

Rate if helps.

Yogesh

Dear Yogdhanu,

chawkideeb — Wed, 22 Jun 2016 08:06:54 GMT

Dear Yogdhanu,

As i understand from you.

it is not necessary to upgrade my firesoght and firepower version.

what i need to do just update the VDB.

can you tell me from where can i get the VDB latest version and how i can upgrade it?

thank you

Navigate to System>updates

yogdhanu — Wed, 22 Jun 2016 08:19:47 GMT

Navigate to System>updates and download the update. It will download the latest VDB update.

Install it and then push the policies once more.

Dear,

chawkideeb — Wed, 22 Jun 2016 08:21:56 GMT

Dear,

please find attached the version that i should update to?

please confirm

Yes that should be right.

yogdhanu — Wed, 22 Jun 2016 08:29:26 GMT

Yes that should be right.

Rate if helps.

Yogesh

Dear ,

chawkideeb — Sun, 26 Jun 2016 15:10:49 GMT

Dear ,

I updated the VDB to the latest version (270),and I can see psiphon application and proxy/anonymizer,

I created a rule to block the above, but with no success.

all the users still can open psiphon.

any idea? please?

your quick feedback is appreciated.

thanks in advance...

Hello Chawkideeb,

Jetsy Mathew — Mon, 27 Jun 2016 04:08:37 GMT

Hello Chawkideeb,

If you already updated the VDB version and still doesnt work then we need to open a TAC request to verify which policy the rule hits and we also need the pcap for this traffic to verify why its not hitting the rule.

In version 5.4.1 and 5.4.1.1 few bugs are there .It would be great if you can upgrade this to a stable 6.0.1.1 version and check the same.

Regards

Jetsy

dear jetsy,

chawkideeb — Mon, 27 Jun 2016 07:01:02 GMT

dear jetsy,

thank you for your response.

I will try to open a tac case, otherwise I will upgrade the firesight and the firepower to the latest version and get back to you.

thank you...

Dear Chawkideeb,

Mohamed Abdallah — Tue, 23 Aug 2016 13:37:06 GMT

Dear Chawkideeb,

Did you succeed to block the PSIPHON via ASA Firepower ?

Regards

Mohamed

Hi,

chawkideeb — Wed, 24 Aug 2016 06:42:56 GMT

Hi,

I did an upgrade to the latest version 6.0.1.1 and VDB also 271.

But I couldn't stop the phsiphon application.

a TAC case was opened (3 days ago) and I am still waiting their feedback (they asked me to provide show-tech and firepower/firesight troubleshooting files.

once the issue was solved I will inform you.

thank you

Best Regards,

Chawki Dib

Dears,

chawkideeb — Thu, 29 Sep 2016 10:31:50 GMT

Dears,

Kindly note that the cisco engineer inform me that it is a bug and that cisco developpers are working on it.

once done they will put on cisco website a new VDB version.

so we should wait

best regards,

chawki dib

Hi Chawki,

ccg-security — Wed, 05 Oct 2016 03:49:52 GMT

Hi Chawki,

We have the same situation. Do you have any update on cisco TAC?

Thank you and Best Regards!

Hi sir Chaw,

romarroca1234 — Wed, 05 Oct 2016 12:31:15 GMT

Hi sir Chaw,

Do you have the update for this? We are planning to buy control license for application blocking but we need to verify if it is already possible.

Thanks and regards,

Romar

Hi,

chawkideeb — Sat, 08 Oct 2016 13:23:28 GMT

Hi,

the Cisco TAC told me that this is a bug and that cisco developpers are working on.

we should wait till the next VDB update to install it and try it.

my current VDB is 271

best regards,

chawki dib

Dear Romarroca,

chawkideeb — Sat, 08 Oct 2016 13:25:24 GMT

Dear Romarroca,

from my side all is okey.

I can block facebook twitter youtube,etc...except psiphon.

the Cisco TAC told me that this is a bug and that cisco developpers are working on.

we should wait till the next VDB update to install it and try it.

my current VDB is 271

best Regards,

Chawki Dib

Thanks mate for the respond.

romarroca1234 — Sat, 08 Oct 2016 23:52:37 GMT

Thanks mate for the respond.

May I ask how do you manage FirePower? is it via FireSight Defence Center? Im managing via ASDM and I cant see to update the ULR filtering updates. and I cant also block Youtube via URL category under streaming media.

We don't have yet the application blocking. if it will block psiphon3, we might get additional license.

Thanks and regards,
Romar Roca

Dear ,

chawkideeb — Sun, 09 Oct 2016 07:11:40 GMT

Dear ,

I am using the firesight GUI interface and not the ASDM.

you can block the URL by typing the URL directly in the rule without creating URL in URL category and then add it to the rule.

best regards,

chawki dib