Definition of proxy users, tor and tunnel

[admins0011111]

Is it possible to determine users that connect to my services by proxy, vpn tunnels or TOR?

I know that IS can block by tor_exit_node, but I need only to determine.

Also I see that SFR can to determine applications like proxy and vpn, but it's not clear how to use it. 

Who as defines such things?

[Claudiu Cismaru]

It's unclear what you want to achieve. Can you refine your question? The sensors can detect user logins through some type of protocols, but I believe you want to achieve something else...

[admins0011111]

Sorry, I just want to see who comes to my sites via VPN or proxy, etc.

[Claudiu Cismaru]

I haven't tried, but you can try to add the lists on Whitelist, deploy the policy and then check in Table View of Connection Events, Security Intelligence Category.

[vaibhav.parlekar1]

Hi, 

There are security intelligence objects for Tor exit nodes. Once you enable them in the security rules for blocking or alerting any user traffic accessing the Tor exit nodes there will be an event generated for the same. 

Hope this is what you are looking for.

[admins0011111]

1) This does not work very well. I tried to go to my services trough TOR many times and all times it worked, my sites were opened.

2) I do not need to block them, I need to know them.