topic Re: Adding URLs to an allow category caused some connections to be blocked in General Topics

Adding URLs to an allow category caused some connections to be blocked

bafergel — Tue, 26 Oct 2021 20:27:40 GMT

We added additional URLs to an existing custom url category and on our URL filtering profile, it is set to alert. These additional URLs are completely unrelated to the connection that started to fail. And as soon as we reverted those changes things began working just as they had before. We checked the URL filtering logs and nothing was being blocked on this connection. It wouldn't drop every connection either, so for example we have a client that was reaching out to a certain IP on the internet on 443. Some were blocked by the default block rule with an application on SSL and others were allowed with an application of incomplete on the rule the traffic should be hitting (they both had the destination of the same IP). But again once we removed those seeming unrelated URLs from the category everything was again allowed and registered as SSL.

Re: Adding URLs to an allow category caused some connections to be blocked

Dalidali — Tue, 26 Oct 2021 21:15:13 GMT

“Incomplete “ session means traffic is not able to complete TCP 3 way handshake or may be there insufficient data transfer

Re: Adding URLs to an allow category caused some connections to be blocked

BPry — Wed, 27 Oct 2021 01:45:57 GMT

@bafergel,

Without knowing what you actually did and seeing exactly what you were trying to do this is going to be difficult to troubleshoot. @Dalidali is correct in the fact that incomplete simply means that not enough traffic was passed for app-id to identify the application. When you look in the detailed log entry for the incomplete traffic are you actually recording return traffic?

Re: Adding URLs to an allow category caused some connections to be blocked

bafergel — Wed, 27 Oct 2021 13:19:09 GMT

Yes there is return traffic, however only a handful of packets so it doesn't appear as if much information passed in these connections. The successful SSL connections pass many more bytes and packets. And the incomplete connections only start appearing when those extra URLs are added, and SSL ones start getting blocked. The policies did not change and while in a broken state I did a test policy match and that traffic should have hit our rule... but it just didn't. These particular clients are configured to reach out to a specific URL, the URLs that were added that broke it did not modify or orverlap with this URL. The added URLs were mostly shopping/sports sites.