Privilege control

In this example, logging in to Microsoft Outlook is blocked by the privilege control settings in the inline CASB profile.

To configure an inline CASB profile with privilege control in the GUI:

1. Configure the inline CASB profile:

   1. Go to Security Profiles > Inline-CASB and click Create new.

   2. Enter a Name, such as outlook_test.

   3. In the SaaS Applications table, click Create new. The Create SaaS Application Rules pane opens.

   4. Set the Application to microsoft-outlook, then click Next.

      

   5. Enable Logging.

   6. In the Privilege Control table, select login and from the Set Action dropdown, select Block.

      

   7. Click OK.

2. Configure the firewall policy:

   1. Go to Policy & Objects > Firewall Policy. Edit an existing policy, or create a new one.

   2. Set the Inspection Mode to Proxy-based.

   3. In the Security Profiles section, enable Inline-CASB and select the outlook_test profile.

   4. Set the SSL Inspection profile to one that uses deep inspection.

   5. Configure the other settings as needed.

   6. Click OK.

To configure an inline CASB profile with privilege control in the CLI:

1. Configure the inline CASB profile:

   config casb profile
       edit "outlook_test"
           config saas-application
               edit "microsoft-outlook"
                   config access-rule
                       edit "microsoft-outlook-login"
                           set action block
                       next
                   end
               next
           end
       next
   end

2. Configure the firewall policy:

   config firewall policy
       edit 6
           set name "casb_test"
           set srcintf "port1"
           set dstintf "port3"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set inspection-mode proxy
           set ssl-ssh-profile "ssl"
           set casb-profile "outlook_test"
           set nat enable
       next
   end

To test the configuration:

1. Open a browser and attempt to access the Outlook login page.

2. The traffic is blocked by the firewall policy. The browser displays a replacement message: Blocked by Inline CASB Control.

   

Sample log:

1: date=2023-08-18 time=16:59:32 eventtime=1692403171962221884 tz="-0700" logid="2500010000" type="utm" subtype="casb" eventtype="casb" level="warning" vd="vdom1" msg="CASB access was blocked because it contained banned activity." policyid=6 sessionid=63635 srcip=10.1.100.195 dstip=20.190.190.130 srcport=61013 dstport=443 srcintf="port1" srcintfrole="undefined" dstintf="port3" dstintfrole="undefined" proto=6 action="block" profile="outlook_test" saasapp="microsoft-outlook" useractivity="microsoft-outlook-login" activitycategory="activity-control"