topic Re: Unexpected behaviour URl filtering web in General Topics

Unexpected behaviour URl filtering web

BigPalo — Mon, 06 Aug 2018 07:46:58 GMT

Hi,

We are having a unexpected behaviour with PA identifying a web:

"rose.pharmaintelligence.informa.com"

This web is categorize like "news". We have in our URL profile "continue". But we are seeing that this web is being denied with reason "policy deny". Why PA is not allowing this web?

Re: Unexpected behaviour URl filtering web

Philip_Wiberg — Mon, 06 Aug 2018 08:03:00 GMT

It would be helpful to see the full traffic log, fields such as the session end reason etc.

Do you have HTTPS inspection activated?

Do you see the continue page?

Does continue work for other HTTPS sites?

Does the site use certificate pinning?

Re: Unexpected behaviour URl filtering web

Remo — Mon, 06 Aug 2018 09:00:32 GMT

@BigPalo

With almost 100% certainty, this is because of TLS decryption. What pan-os version are you using?

The issue here could be related to the fact that this site already supports TLS1.3 and the firewall somehow does not understand the TLS handshake correctly even if a connection with TLS1.2 is still possible.

Try to configure a decryption exception to check if it then works. ~~But anyway, in this case I would recommend to open a TAC case.~~

Re: Unexpected behaviour URl filtering web

BigPalo — Mon, 06 Aug 2018 08:45:07 GMT

When end-customer access to this web by https received a security event about security stuff. So customer delete https, and put http so the continue web is showed.

No decrypt ssl policy in the FW

PanOs is 8.0.3

Re: Unexpected behaviour URl filtering web

Remo — Mon, 06 Aug 2018 09:35:17 GMT

In this case it is at least related to TLS decryption. Without TLS decryption configured the firewall is not able to inject the continue page and because of that you probably have this traffic log entry when users go directly to the encrypted version of the website.

When the users manually enter http:// then as you wrote the users are able to see the continue page and continue also to the website right?

Re: Unexpected behaviour URl filtering web

BigPalo — Mon, 06 Aug 2018 09:43:45 GMT

Yes, but how can we change the TLS? any workaround?

Re: Unexpected behaviour URl filtering web

Remo — Mon, 06 Aug 2018 09:50:16 GMT

Are the customers computers managed computers (where you could deploy a root CA cert)?

The best "workaround" probably is to configure TLS decryption to get a behaviour as it should be ...

PS: I would definately recommend to update to the latest recommended 8.0 release which is 8.0.10

Re: Unexpected behaviour URl filtering web

BigPalo — Mon, 06 Aug 2018 09:51:26 GMT

But customer is not doing decrypt ssl.

Re: Unexpected behaviour URl filtering web

Remo — Mon, 06 Aug 2018 09:54:29 GMT

Yes, I understood.

Then your only chance is this one here: https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Serve-a-URL-Response-Page-Over-an-HTTPS-Session-Without/ta-p/55998

Re: Unexpected behaviour URl filtering web

BigPalo — Mon, 06 Aug 2018 09:57:54 GMT

OK, Perfect. So you have a response page "continue" and you access to https web, its mandatory to have decrypt ssl for this web? there no any way to identify this web without https decrypt?

it was weird because the web it was identify in the correct category "news"

Re: Unexpected behaviour URl filtering web

Remo — Mon, 06 Aug 2018 10:02:15 GMT

The URL I posted describes a way to serve the resonse page to users without TLS decryption.

The firewall is able to see the URL - at least the FQDN - in the TLS handshake even without decryption. But by default the firewall is not able to inject the response page into this connection as this is only possible when the firewall sees the actual http traffic. So try the solution in the url and hopefully this will solve the issue for you/your customer.