topic Re: URL Log displays a lot of '%16%03%01/' as url for SSL traffic in General Topics

URL Log displays a lot of '%16%03%01/' as url for SSL traffic

obor — Wed, 04 Sep 2013 07:55:51 GMT

What's wrong with the URL filtering and logging of the PaloAlto FW? We have many URL logs like '%16%03%01/' when users visit SSL websites.

Is URL detection for SSL websites broken?

Are there other users who have this problems?

We are not 100% sure but it seems this log happens only when Internet Explorer 8 is used. But still investigating

Regards,

O. Bor

Re: URL Log displays a lot of '%16%03%01/' as url for SSL traffic

harshanatarajan — Wed, 04 Sep 2013 08:00:41 GMT

What is the Apps and threat content version on the firewall ? Is it 390 ?

Re: URL Log displays a lot of '%16%03%01/' as url for SSL traffic

harshanatarajan — Wed, 04 Sep 2013 08:06:58 GMT

There is a known issue in version 390. I would recommend you to upgrade to the new version 391 which was released few hours ago. That should resolve.

Re: URL Log displays a lot of '%16%03%01/' as url for SSL traffic

HULK — Wed, 04 Sep 2013 08:08:47 GMT

Yes, there is some issue with the version 390. Engineering is currently working on it. The issue is that the SSL sites are being categorized as "private-ip-addresses" after upgrading the content to version 390.

Issue reported as:- "SSL sites are being categorized as 'private-ip-addresses' after upgrading content to version 390". Only IE8 seems to be affected.... Chrome, Firefox and IE9 seem to be not be affected. As of now, the workaround would be to revert to content version 389/ update to content version 391 or do not block 'private-ip-address' category.

Thanks

Re: URL Log displays a lot of '%16%03%01/' as url for SSL traffic

obor — Wed, 04 Sep 2013 08:20:24 GMT

I was aware of the problems with 390 and a few hours ago we have upgraded to 391 and we have still these url logs. Thats why i posted this to ask if more people have the same issue. So it seems that 391 is still having this issue.

Thanks for all responses.

Re: URL Log displays a lot of '%16%03%01/' as url for SSL traffic

harshanatarajan — Wed, 04 Sep 2013 08:35:54 GMT

Are these sites being categorized as "private-ip-address" with version 391 ?

Re: URL Log displays a lot of '%16%03%01/' as url for SSL traffic

obor — Wed, 04 Sep 2013 09:14:15 GMT

yes, these sites are still categorized as "private-ip-addresses" with in version 391. I have already cleared my url cache and dynamic host cache.

Re: URL Log displays a lot of '%16%03%01/' as url for SSL traffic

JRussell — Wed, 04 Sep 2013 13:27:18 GMT

Thanks so much for this info. I have been sitting here scratching my head and talking to my support people who didn't have a clue either. I would have thought it would be URL filtering or something, not Application and threat.

Sticking with 389 for now until this is resolved.

Re: URL Log displays a lot of '%16%03%01/' as url for SSL traffic

mbutt — Wed, 04 Sep 2013 17:23:57 GMT

Hi,

We have just verified that the issue is resolved in 391 and are not seeing it anymore. Please verify the device did upgrade to latest content version.

You can use "show system info" command to verify that.

However if you are seeing the issue please open a case with TAC so we can look at the issue and get it to closure.

Thank you

Numan

Re: URL Log displays a lot of '%16%03%01/' as url for SSL traffic

obor — Wed, 04 Sep 2013 22:11:03 GMT

yes, we are running version 391. But we managed To gather more info and we only see these log when users visit the salesforce.com website. Salesforce is an appid, and no salesforce app detection but SSL app detection and wrong URL and category.

maybe this info can help.