At present no reliable way to block Tor Browser?

Question

Although I had enabled "Filter avoidance apps" (app control) as well as SSL inspection, Tor Browser managed to connect to the internet. As Sophos support told me on the phone, this problem seems to be known. 
 Are there any experiences here in blocking Tor Browser reliably? Maybe more steps are necessary to block, like outlined here for another manufacturer?

KingChris · Accepted Answer

Hi Sacha Roland 
 You have "any service" selected on your rules. As you have stated TOR is designed to work around proxies and firewalls such as the XG. 
 We have to make it harder for them to do so. As TOR is updated more frequently, we are only able to create signatures based on the files seen in the wild. The TOR user/dev community will not give us the file before they release it so that we can have signatures created beforehand. 
 So in order to make it harder for TOR to be blocked, you have to limit ports outbound. For DNS outbound, limit to port and DNS providers. 
 There are a lot of posts on here about Psiphon being blocked. Search for them to see what else has been done to limit that application. 
 You should also increase the maximum amount of packets that get scanned before IPS makes a decision on what type of traffic it is. You can do this by going to the "Console" and running command: set ips maxpkts 100 
 Ensure that the following settings have been set on the web proxy: 
 Block PUAs 
 Enable pharming protection 
 Block invalid certificates 
 Block unrecognized protocols 
 The above settings are in addition to limiting outbound ports/services and locking down any other rules with "any service" to a specific IP. 
 Let us know how it goes. 
 Thanks!