APP vs URL

robert.b — Mon, 21 Jun 2010 12:56:47 GMT

Despite the fact that I've blocked *.logmein.com and the logmein application, I'm still seeing traffic permitted to logmein.com. On inspecting the traffic log details, I can see that the traffic is being identified in 2 ways:

06/21 13:07:59 THREAT url ssl block-url URL Default Severity: informational Category: Blocked sites URL: *.app03-10.logmein.com/

06/21 13:09:51 TRAFFIC end ssl allow URL Default Bytes: 8630 Packets: 18

Is this because I've got SSL permitted and APP beats URL? I'd expect traffic to be denied if any part of it was being blocked, but this does not appear to be the case.

I'm thinking that SSL Decryption is the only option to stop this traffic as the logmein application is encrypted, or an explicit deny for SSL to loginme.com.

Is this correct?

Re: APP vs URL

James — Mon, 21 Jun 2010 17:32:27 GMT

Hi Robert,

The rules are applied in a top down fashion - so if traffic matches an allow rule before getting to the deny rule, there will be no further matches. Except of course, if the application or application function changes.

SSL Decryption does happen before the Security Policies are applied - so if the application is inside HTTPs, it will get matched correctly (assuming all other parameters are set correctly for the SSL decrypt to happen).

Just as a note, in case you are using the service column as well - when decrypting, you'll still see port 443 in the logs since this does not change.

Hope this helps?

Thanks

James

topic APP vs URL in General Topics

APP vs URL

Re: APP vs URL