topic Re: Url Filtering in General Topics

Url Filtering

markk96 — Fri, 10 Oct 2014 01:36:57 GMT

I am trying to figure out url filtering. My company has me blocking web-based email url category. I have just been asked to allow certain users access to https://gmail.google.com so I created a custom url category and placed https://gmail.google.com in it and then created a rule with the source interface, the domain group and the destination interface, and the custom url category and set it to allow. I did not add a url profile. I cannot get this to work. I keep getting accessed denied.

Re: Url Filtering

ssharma — Fri, 10 Oct 2014 01:47:11 GMT

Hi Markk96,

Do you have ssl decryption enabled on your device? If not it might be difficult to what you are trying to achieve as the HTTP GET message for gmail.com would be encrypted, and firewalll would have no idea what URL user is trying to reach.

In the URL category where you have web-based email, go ahead add following under allow list

mail.google.com

google.com

*.google.com

And see if that makes any difference. Hope this helps. Thank you.

Re: Url Filtering

bat — Fri, 10 Oct 2014 01:50:59 GMT

markk96

Could you try creating a URL filtering profile as below and refer that in the policy:

The above URL filtering contains web-based-email category as blocked.

Re: Url Filtering

hshah — Fri, 10 Oct 2014 02:22:40 GMT

Hi Mark,

Clone Existing URL filtering profile, search for custom profile. Allow that custom URL profile.

Now create new rule, reference this particular URL Profile in it.

This is another way and it will work for sure.

Regards,

Hardik Shah

Re: Url Filtering

DavePATS — Fri, 10 Oct 2014 03:40:35 GMT

Troubleshoot this by looking in the URL logs. Look at the syntax in the URL column and model your entries in the custom URL profile off of what is seen in the URL logs. Sometimes you might need to include *.domain.com/*.

How To Create Custom URL Categories

Re: Url Filtering

markk96 — Fri, 10 Oct 2014 04:12:24 GMT

How do policy rules work in this case. If I have the following rules what order should they be in, if users are in a special group to access gmail. I want to make sure that no other traffic goes over the gmail policy.

1. allow user group "Allow Gmail" with url category gmail and url policy gmail allow.

2. all any any any with url policy webased email blocked.

Re: Url Filtering

DavePATS — Fri, 10 Oct 2014 18:02:39 GMT

Mark,

The order you have is correct. The "Any/Any/Any + URL category web based email block." rule must come second since it would shadow the allow rule above.