URL Lookup Returns IP Address

BobbyHiers — Mon, 20 Nov 2023 13:33:41 GMT

We use a URL filtering profile to limit outbound traffic. Occasionally known good traffic will fail because an IP address, instead of the FQDN of the URL, is presented. The traffic is blocked because the URL (IP address) is in the "Unknown" URL category. What could be the cause of this random failure?

Re: URL Lookup Returns IP Address

akuzhuppilly — Tue, 21 Nov 2023 09:20:40 GMT

Hello @BobbyHiers

The firewall identifies the Fully Qualified Domain Name (FQDN) from the Server Name Indication (SNI) in the client hello or from the Common Name (CN) in the server hello.

In your scenario, the firewall is detecting the SNI or CN as the IP, and the category detected is marked as private IP/Unknown.

You can test the category using the following URL: https://urlfiltering.paloaltonetworks.com/query/

To better understand what is happening and why the firewall is interpreting the IP instead of the URL/FQDN, you may conduct a packet capture. This will help you analyze the network traffic and identify any issues affecting the firewall's interpretation.

topic URL Lookup Returns IP Address in Next-Generation Firewall Discussions

URL Lookup Returns IP Address

Re: URL Lookup Returns IP Address