Block Google Drive Without Decryption

|
  • 178
  • 6

Issue Description

Block user access to the Google Drive website and application. Sometimes the policy failed due to Google Drive is using Https and the NGAF is unable to perform decryption to decrypt the Https website. So, it might have the chance the application control policy to fail.

Handling Process

  • Block google QUIC protocol. For more information about QUIC protocol, please refer to QUIC info.

        
2. Create an application control policy that blocks Google Drive application and Google QUIC that has already created at first step.
      
3. Next, we need to create a custom URL to block the Google Drive URL.
      
For best practice, we need to create the URL according to this 3 format.
-google.com
-*.google.com
4. After creating the custom URL, you need to create a content security policy to use it.      
Depend on your case you can also select the Network Storage to block all the network storage URL. If your case only wishes to block the Google Drive so you do not require to tick it. Else, it will cause all the network storage website unable to access.

5. After complete the above step, the user should not be able to access Google Drive, but unfortunately, the user sometimes still be able to access it.
Remind: As a suggestion, decryption is needed.  But sometimes, the NGAF version is not supporting decryption or the device does not have purchase SSL decryption license.
After we capture the packet that access to Google Drive and found the several Google drive server domain name in the packet.
      
      
      

Therefore, we need to go back to step 3 and add these 3 domain name into the custom URL.
      

Root Cause

Some of the NGAF does not have the SSL decryption license or does not have this decryption module to decrypt the Https website. So, this will cause the policy to have the chance to fail.

Solution

It is not enough to add the drive.google.com domain name into the custom URL. Also, require to add the Google Drive server domain name we found in the packet into the custom URL which is the following URL:
  • drive.google.com
  • *.drive.google.com
  • www.drive.google.com
  • www.gstatic.com
  • csi.gstatic.com
  • clientservices.googleapis.com

Faisal Posted 14 Aug 2020 08:58
  
Thank you very much for the information ...
Muhammad Bilal Lv4Posted 05 Sep 2020 14:51
  
Thank you for the sharing information
Faisal Posted 30 Oct 2020 11:12
  
Nice article ...
Faisal Posted 10 Dec 2020 09:27
  
Great info ...
Faisal Posted 12 Mar 2021 07:29
  
Very informative …
Faisal Posted 28 May 2021 07:14
  
Nice guidance ...

I want to write a case
Doc ID: 2456
Author: CTI Jimy
Updated: 2019-12-24 10:57
Version: