topic URL Filtering For Inbound Servers in General Topics

URL Filtering For Inbound Servers

SubaMuthuram — Wed, 23 Mar 2022 07:36:09 GMT

Hi Team,

will it actually make sense to apply the URL Filtering for the Inbound traffic to our Internal Server?

Re: URL Filtering For Inbound Servers

kiwi — Thu, 24 Mar 2022 14:12:28 GMT

I see one use-case where you could apply URL filtering to restrict the incoming URL to something specific ... in order to prevent folder hopping or directory searching.

Cheers,

-Kiwi.

Re: URL Filtering For Inbound Servers

BPry — Fri, 25 Mar 2022 00:37:41 GMT

@SubaMuthuram,

There's some very specific scenarios where it can be useful in certain edge cases, but it's not generally something that I would worry about. Generally speaking creating custom App-IDs, and where needed vulnerability signatures for something like ECP in an on-prem Exchange environment, is more useful for the vast majority of environments.

Re: URL Filtering For Inbound Servers

SubaMuthuram — Mon, 28 Mar 2022 11:20:32 GMT

Hi Team,

Thanks for the reply, One of our client has the below issue, Whenever they trying to access their internal server from outside, in the URL filtering the traffic is categorized as Adult category and the URL showing xnxx.com

Please refer the below image,

Please enlighten me what is the logic behind this, Is it indicating the traffic from malicious IP address.

Re: URL Filtering For Inbound Servers

reaper — Mon, 28 Mar 2022 11:42:10 GMT

in the URL the customer is using, does it contain xnxx.com in any way? you may need to disable "log container pages only" in the url filtering profile to see this information

you could try the following:

create a custom url category containing the right URLs for the internal webserver

set the custom category in the services/url tab of the security rule

remove the url filtering profile from the security profiles