Best practice for App filtering but allow almost everything
Hi,
We are running Palo Alto Firewalls as our main ips Firewall. Since the past years our strategy has been allowing port 80 and 443 and filter application SSL and web browsing. But nowadays we are dealing with lots of separate applications, for example AI applications or even websites like ecosia.org now have their own application signature. Our web browsing rule now has over 80 different apps in it and it's growing, resulting in many unwanted tickets for: please fix this web application access.
Is this how it's designed, or how we could build a rule that has more of a blacklisting approach than whitelist but without allowing harmful applications on 443?
Of course I could build 2 rules with disallow everything unwanted and a second allow rule with application any in it. But this doesn't filter anything I don't know about.
So basically our security policy is: everything that is HTML / a normal website, is okay, but we don't want to allow things like Teamviewer or ssh or any unknownen non Web applications
We are not allowed to do SSL inspection by the way