topic Re: Problem with URL Filtering in Next-Generation Firewall Discussions

Problem with URL Filtering

H.Sutanto — Mon, 29 Apr 2024 05:07:42 GMT

Hi,

I have an issue with PAN URL Filtering, where I still able to access website that has been blocked.

For example:

If I open http (http://nanime.live) the website is blocked

But if I open using https, website can be accessed

When I check on monitor -- logs -- url filtering, nanime.live is blocked

Please your help

Thank you

Re: Problem with URL Filtering

reaper — Mon, 29 Apr 2024 10:12:01 GMT

can you try running the developer tools > network in your browser, to see what is being let though?

(did you make sure your browser cache has been cleared)

Re: Problem with URL Filtering

jfernandez1 — Mon, 29 Apr 2024 19:24:48 GMT

Hello Friend!

URL filtering works different when using HTTP or HTTPS, since some payload might be encrypted or not, on the following KB you can find the reasons behind each behavior: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HAL0

Mark this comment as solution if you think this information is useful for you

Re: Problem with URL Filtering

H.Sutanto — Tue, 30 Apr 2024 07:32:18 GMT

yes, i have try running the developer tools

left (using http) and right using https

Re: Problem with URL Filtering

reaper — Tue, 30 Apr 2024 08:45:08 GMT

if you access that website and look at the certificate, it appears that the certificate is reflecting a different URL (laznasphr.kilatdigital.com), which could be why the connection is seemingly being allowed

In SSL connections, URL filtering uses the certificate SNI instead of the HTTP GET

Re: Problem with URL Filtering

H.Sutanto — Thu, 02 May 2024 08:04:11 GMT

I tried to access another website moenime.com, when I check the hostname certificate same as the URL, but still can be accessed.

please your advice.

Re: Problem with URL Filtering

reaper — Thu, 02 May 2024 09:27:17 GMT

what does your logging report? Are you hitting a different rule, is the website reported as a different URL/category?