Is it possible to block Tor Browser when connected to a VPN via Cisco AnyConnect

Hi,

You are going to define an application policy and apply it in the firewall rule.

Thank you, I will try that. But I am wondering: how is it technically possible that the FW can examine the encrypted traffic that happens between a client computer and the VPN endpoint? How can the FW search in this encrypted traffic for app signatures? Or didn't I get the the overall concept at all?

Firewall Blocks application at the UDP level...

Firewall blocks application at the UDP level and application databases keep updating on the Firewall. So far you are connected to the Firewall and your traffic is passing through the firewall whether via vpn or Lan and your application policy has been well defined, the firewall would match your policy to block the app you defined in your firewall rule

Hi,

There are two basic scenarios :-

1/. The applications are seen by the firewall

a) using application and web poiicies after you install the XG CA on your devices.

b) the connections are going through the web proxy and using known protocols.

c) the VPNs originate or terminate on the firewall.

in this case you can block TOR.

2/. The VPNs start on the users device

a) the firewall will not be able to inspect the traffic within the VPN because it does not have the details of the connection eg shared key, negotiated connection security settings.

In this case you will not be able to block TOR.

Ian

Thank you very much for your detailed answer. So I assume, I'll have to deal with Scenario 2 because users connect into the VPN by the Cisco AnyConnect client. Will it be possible to let the XG itself establish the VPN connection, or is it impossible due to the proprietary character of the client?

Thank you very much for your detailed answer. So I assume, I'll have to deal with Scenario 2 because users connect into the VPN by the Cisco AnyConnect client. Will it be possible to let the XG itself establish the VPN connection, or is it impossible due to the proprietary character of the client?

Using Cisco anyConnect, the XG only respond to connection, it does not initiate it..

Hi,

I have no experience with this answer, just theory.

If you have integrated the XG into your AD then you might be able to control what applications the users are allowed to run from within the AD.

Using the AD I think will allow you to setup permitted VPN parameters.

I would search the forums for some answers as to VPNs that currently work and how to set them up or buy some time from your reseller/partner.

Ian