Belajar Bluecoat - Blocking Google Talk

While ProxySG does not yet have a Google Talk (using the "jabber" protocol) specific proxy, it is possible to block Google-Talk access on both the native client and Gmail interface. 

First enabling a HTTPS-proxy service on port 5222 and arrange for that traffic to reach the ProxySG. If this is an inline deployment, nothing special needs to be done.

Second configure policy to SSL-intercept and deny all HTTPS traffic to "Chat" and "Search/Engines" categories. While the chat category is obvious, the Search category is also necessary to address G-Talks attempt to connect to any Google owned IP. The chance of over-blocking HTTPS search sites is small (it's unclear why a web-search site would be HTTPS), but could be addressed with a more complex policy.

Example policy for step two.

    server.certificate.hostname.category=("Chat/Instant Messaging", "Search Engines/Portals") ssl.forward_proxy(https)

Deploying a certificate to client computers is not necessary as the goal is to deny this traffic.

Finally configure denials for port 5222 and the Google-Talk client. The gmail chat interface uses AJAX calls to "/mail/channel/bind" to log a user into G-Talk and retrieve the login status of friends.

Belajar Bluecoat - Client side attack detection pada Bluecoat ProxySG

Pada proxy bluecoat kita bisa melakukan pembatasan session user/client ,hal ini digunakan untuk mendeteksi serangan dari client.

Untuk mengaktifkannya gunakan perintah :

Blue Coat SG9000 Series#conf t

Blue Coat SG9000 Series #(config)attack-detection

Blue Coat SG9000 Series #(config attack-detection)client

Blue Coat SG9000 Series #(config client)enable-limits

Blue Coat SG9000 Series#(config client)view

Client limits enabled: true

Client interval: 20 minutes

Default client limits:

Client connection limit: 100

Client failure limit: 50

Client warning limit: 10

Blocked client action: Drop

Client connection unblock time: unlimited

untuk menonaktifkannya gunakan perintah :

Blue Coat SG9000 Series#(config client)disable-limits

untuk menset TCP limit per IP individu gunakan perintah :

Blue Coat SG9000# conf t

Blue Coat SG9000#(config) attack-detection

Blue Coat SG9000#(config attack-detection) client

Blue Coat SG9000#(config client) enable-limits

Blue Coat SG9000#(config client) create 192.168.168.168

Blue Coat SG9000#(config client) edit 192.168.168.168

Blue Coat SG9000#(config client 192.168.168.168) connection-limit 50

Lakukan pengecekan session ip

https://IPPROXY:PORT /tcpcc/show