topic Url problem in General Topics

Url problem

Fagani — Mon, 16 May 2022 11:52:18 GMT

Hello everybody.

I allow a url. I also allowed categories for that url, but the site still doesn't work properly. There is a problem connecting to a server on that site and it is deny

Thanks in advance

Re: Url problem

PavelK — Mon, 16 May 2022 12:14:30 GMT

Hello @Fagani

would it be possible to get more details? What are you seeing in URL and Traffic logs?

Kind Regards

Pavel

Re: Url problem

Fagani — Mon, 16 May 2022 13:01:32 GMT

When the internet is full, everything works fine.

However, the site does not fully open when provided with limited internet. Paloalto records show visits to surveymonkey.com. These visits apply to different servers. There is only one server to which deny answers come from

Re: Url problem

PavelK — Tue, 17 May 2022 12:50:42 GMT

Thank you for reply @Fagani

unfortunately based on information from your reply, I am having a difficulty to understand what the issue could be. If I were in your situation, my starting point would be looking into URL logs. The first thing I would make sure that all allowed URL categories have action set to alert. Alert action allows traffic and records the logs. Also for the policies that are getting hit by this traffic, I would check in the traffic logs for "byte received" to confirm there is a response from web server.

Kind Regards

Pavel

Re: Url problem

Fagani — Wed, 18 May 2022 13:01:23 GMT

@PavelK Thank you very much for answering me

Re: Url problem

FBMTRAV — Wed, 18 May 2022 14:21:45 GMT

We are having similar issues with security rules getting hit when a URL category is referenced. We moved the URL to destination instead of URL category and it fixed our issues. Let me know if you need more info on that and I can share our findings from the Palo Alto support case.

Regards,
Travis

Re: Url problem

Fagani — Thu, 19 May 2022 06:39:35 GMT

@FBMTRAV Thank you very much. I need to know more about palo alto. I will be glad if you help

Re: Url problem

FBMTRAV — Thu, 19 May 2022 12:02:24 GMT

Okay, so to go into more detail, I'll explain how our URL security rule was written when it was broken and how we changed it to fix the problem.

1. In a broken state, we had a security rule with the URL referenced in a custom URL category. That Custom URL category was then added to the security rule.

2. To Fix the problem we changed the URL Category in the security rule to Any and added each URL we wanted to permit in the Destination. When you add a URL to the destination of a security rule, you'll need to create an address object and choose FQDN.

Hope that helps!