How to successfully block Psiphon VPN in the security policy

To Block Psiphon VPN using firewall Security Policy.

• Palo Alto Firewalls
• Supported PAN-OS
• Decryption
• SSL Forward Proxy 
   

1. Configure a Decryption profile for decrypting traffic in the desired zones.

2. Name the clone profile as Psiphon-decrypt-profile (or any name you want).
3. Under SSL Decryption > SSL Forward Proxy:
   1. Under Server Certificate Verification:
      1. Check: Block sessions with expired certificates
      2. Block sessions with untrusted issuers
      3. Block sessions with unknown certificate status
      4. Block sessions on certificate status check timeout
   2. Under Unsupported Mode Checks
      1. Check: Block sessions with unsupported versions
      2. Block sessions with unsupported cipher suites
4. Commit the changes.