topic Re: Website blocked based on key words in General Topics

Website blocked based on key words

MMCiobanu — Wed, 12 Feb 2014 22:24:01 GMT

Hi,

I am having issues accessing this website: http://social.technet.microsoft.com/Forums/systemcenter/en-US/04400522-edd7-412f-8461-276ca3c0c88c/sccm-2007-client-unistallation-and-monitoring-the-unistallation-using-batch-file?forum=configmgrsetup

The firewall blocks it based on the File Blocking profile that includes bat and cmd files among the file types that should be blocked; however, the site does not contain a bat file, but rather the word batch and commands from a batch file pasted in the forum. I find this rather strange, as the File Blocking filter should only look at the files extensions.

Re: Website blocked based on key words

HULK — Thu, 13 Feb 2014 00:48:00 GMT

Hello Sir,

I do agree with you. The PAN FW is blocking this URL with below mentioned information under "data-filtering" log.

The specified URL contains some of the windows batch files output on this discussion. I hope that triggers the signature to block the content, because the PAN firewall is signature based not based on file-extension/URL.

For example: If you transfer a txt file which contains signature of a EXE file, the PAN will identify that file as EXE not TXT.

Thanks

Re: Website blocked based on key words

MMCiobanu — Thu, 13 Feb 2014 20:37:37 GMT

Thank you; I guess not much we can do to allow these type of websites, but still blocking actual bat files.

Re: Website blocked based on key words

MMCiobanu — Tue, 18 Feb 2014 17:24:07 GMT

Is there any way we can create an exception, so outputs of bat files are not blocked on certain URLs, like this particular one?

Re: Website blocked based on key words

HULK — Tue, 18 Feb 2014 17:59:17 GMT

Hello Sir,

You can create a custom URL category and attach along with a profile.

Example:

http://social.technet.microsoft.com

*.social.technet.microsoft.com/*

Thanks

Re: Website blocked based on key words

Phoenix — Tue, 18 Feb 2014 19:04:14 GMT

Hi MMCiobanu

To add to Hulks point after creating custom url category for the specified site or sites having similar issue and configure the URL profile with this custom url profile. Also make sure no Data filtering is enabled for this security rule so that it does not process the Bat files.

Re: Website blocked based on key words

MMCiobanu — Tue, 18 Feb 2014 19:09:14 GMT

Yes, the website is allowed as part of the URL custom category; but, it seems to be blocked by the Data Filtering profile, which includes blocking bat, cmd, exe files.

I will try your suggestion and disable Data Filtering on that specific rule.

Thank you.

Re: Website blocked based on key words

MMCiobanu — Tue, 18 Feb 2014 20:59:39 GMT

The problem I see with this is that, because the Data Filtering is actually blocking the site, I can't have trust-any to untrust-any without data filtering, while I have one already with data filtering enabled. It does not look like I can have a rule only for a particular URL with Data Filtering off.

Re: Website blocked based on key words

Retired Member — Wed, 19 Feb 2014 05:38:56 GMT

You can do this by the steps :

1- configure the custom url object as

2- Create an address object

3- Use a policy with destination address object and URL Category object with web-browsing application without any Data filtering profile.

Page will be loaded correctly.

Re: Website blocked based on key words

MMCiobanu — Wed, 19 Feb 2014 17:41:42 GMT

Thank you; This worked well.