topic Re: using url categories in security rule base blocks allowed traffic in General Topics

using url categories in security rule base blocks allowed traffic

mr.linus — Thu, 23 Jul 2015 14:02:32 GMT

Hey all,

We have a security rulebase which is causing some bizarre issues.

rule 1:

trust to untrust
service: tcp-80
url category: online-storage
url filtering profile: alert-all
allow

rule 2:

trust to untrust
service: tcp-80
url category: /
url filtering profile: alert-all
allow

when we do some web traffic to www.bing.com we get 2 different type of results

A) we hit rule 2

traffic logs show: allow

url filtering logs show: category = search-engines - action: alert

B) we hit rule 1

traffic logs show: allow

url filtering logs show: category = any (??) - action: block

what I think is happening in situation B is: Traffic is hitting rule 1, and because at this stage the PaloAlto does not know the url category it will allow traffic through this rule (zone and service are a hit). After some packets the url category is known as search-engines => this means the traffic is actually not allowed by rule 1 and thus traffic is dropped (even though there is a rule 2 which would have allowed this traffic!). The category = "any" in the url filtering logs is just some strange behaviour of the PaloAlto.

Now I know this rulebase does not make sence, but it's just a recap of what is happening. The actual rules involve different user-groups and allowed applications.

Question is:

Anybody else find this kind of behaviour.

Why is traffic sometimes hitting rule 1, and sometimes rule 2?

Re: using url categories in security rule base blocks allowed traffic

mmmccorkle — Thu, 23 Jul 2015 21:37:21 GMT

This may have already been mentioned, but I'd highly suggest you use the URL Filtering profile categories to filter categories instead of putting it into that portion of the rule itself.

Re: using url categories in security rule base blocks allowed traffic

Brandon_Wertz — Sat, 25 Jul 2015 22:03:55 GMT

using them in the rule is a way to get around paying for the service.

Re: using url categories in security rule base blocks allowed traffic

Brandon_Wertz — Sat, 25 Jul 2015 22:05:40 GMT

What's the intent of using a URL Category in security policy in conjunction with a URL Profile?

Re: using url categories in security rule base blocks allowed traffic

mmmccorkle — Sat, 25 Jul 2015 23:22:56 GMT

I believe that the engine is still active, we just have to create our own custom categories instead of using the pre-defined ones with the purchased license.

Thanks!

Re: using url categories in security rule base blocks allowed traffic

Brandon_Wertz — Sun, 26 Jul 2015 02:11:44 GMT

I can't keep it straight if using it in security policy either doesn't create a URL log or doesn't allow you to use a URL response page, but I know it's one of them as well.

Re: using url categories in security rule base blocks allowed traffic

mmmccorkle — Mon, 27 Jul 2015 02:57:52 GMT

The only way URL Filtering logs will be created is if we have a URL Filtering Profile attached to the rule passing the traffic and the action is set to anything but Allow. (Alert, Block)

Re: using url categories in security rule base blocks allowed traffic

mr.linus — Mon, 03 Aug 2015 08:05:20 GMT

Hey All,

I have been investigating this issue with PaloAlto tech support and we found the issue.

We've been able to track the trigger condition down to safe search enforcement setting on the URL profile. For some reason, the string "FORM=IE" from the URL will trigger this behavior. So for some reason this would make it so search traffic to BING sometimes hit rule 1, and sometimes hit rule 2.

But I do agree that using URL categories in the rulebase is just asking for trouble.

Re: using url categories in security rule base blocks allowed traffic

mr.linus — Tue, 04 Aug 2015 08:25:56 GMT

Dear

Please note that: using url categories in a security policy, instead of a security profile does NOT work if you do not have a license.

You still need an active license to be able to use url categories.

You do not need a license to use custom url categories, which you can then use in security policies as well as in security profiles.

The use in policy or profile has nothing to do with license.