Browser Based VPNs Block

Both NGAF and IAM failed to block the browser-based VPN.
Is anyone facing the same issue?

The Network Gateway Application Firewall (NGAF) and Identity and Access Management (IAM) systems, which typically serve as barriers against unauthorized access and maintain control over network traffic, have failed to block these browser-based VPNs. This issue might be widespread, as others could be encountering similar difficulties in preventing these tools from circumventing security protocols. It highlights a need for stronger defenses or updated measures to counteract such evasive tactics used by these VPNs.

You can block it by blocking Port 838 or by block it by blocking games in application control policy (because these ports lie in gaming content)

Go to policy and create a policy to block the traffic
in application drop down select the following ( Games , Proxy tools, Trojan horse, sangfor VPN , Others)

Hi, you can try to block the specific browser vpn port in order to deny clients to use Sangfor. You can create a specific policy to do that.

You can try to block Port 838 in control policy or you may below steps:

1. Check for updates and make sure both are up to date
2. Seek assistance from Sangfor support for immediate assistance and resolution

Browser-based VPNs often use encrypted traffic to bypass traditional firewall and filtering mechanisms. Ensure that your NGAF and IAM are configured to inspect and filter encrypted traffic.

Verify that SSL/TLS inspection is enabled on both NGAF and IAM. This allows them to decrypt and inspect traffic even if it's encrypted. Note that SSL/TLS inspection may require additional configuration and proper handling of certificates.

Check if the NGAF and IAM policies explicitly block the protocols and ports associated with the browser-based VPN. Ensure that the firewall rules are configured to deny access to the VPN protocols.

NGAF often provides application layer filtering capabilities. Ensure that your NGAF is configured to detect and block the specific application or VPN protocol used by the browser-based VPN.

Implement dynamic blocking rules based on behavior analysis. For example, you can set rules to identify and block suspicious traffic patterns associated with VPN usage.

Ensure that your NGAF and IAM have the latest signatures and definitions for VPN applications. Regularly update the application and threat databases to stay ahead of new evasion techniques.