topic You can decrypt and inspect in Network Security

Cisco ASA - Block access to Google G-Suite consumer accounts

stuart.kirby1 — Tue, 12 Mar 2019 08:46:34 GMT

Hi All,

Our company is trialing a proof of concept for Google G-Suite (Google Apps). Our security team have requested us to block access to G-suite so that only our company email domains can sign in and block personal Google accounts.

Google's solution is to add a http header to all packets going to google.com and specify which domains are allowed to sign in.

https://support.google.com/a/answer/1668854?hl=en

We currently have a Cisco ASA 5515 firewall. Does anyone know if this is possible on a Cisco ASA firewall and what steps are required?

Any help would be appreciated.

Thanks

Stuart

You cannot do that directly

Marvin Rhoads — Fri, 13 Jan 2017 15:38:26 GMT

You cannot do that directly with an ASA. The Google-recommended solution might be possible with a Cisco Web Security Appliance.

A more apt solution from Cisco would be to look into the Cloudlock product.

Hi Marvin,

stuart.kirby1 — Fri, 13 Jan 2017 15:55:37 GMT

Hi Marvin,

Thanks for the response. Do you now if there are any features which are part of the FirePOWER services which could do what Google recommend?

Thanks

Stuart

You can decrypt and inspect

Marvin Rhoads — Fri, 13 Jan 2017 15:58:49 GMT

You can decrypt and inspect SSL payload with FirePOWER but I don't believe anything in FirePOWER allows you to insert or modify headers.

Ok, thanks for your help.

stuart.kirby1 — Fri, 13 Jan 2017 16:15:33 GMT

Ok, thanks for your help.