topic URL Filtering different with browser and application in General Topics

URL Filtering different with browser and application

rjdahav163 — Thu, 08 Nov 2018 09:51:15 GMT

We have a server, from where the user wants to go to, for example, abc.xyz.com.

The certificate from the website xyz.com has a CN *.xyz.com.

We dont have decryption for URL Filtering. In the URL Filtering category, we have allowed abc.xyz.com.

The user on the server wants to use an application which initiates a connection to abc.xyz.com.

Now,

When the user opens a browser and goes to abc.xyz.com, then the connection is allowed as the firewall sees the URL as abc.xyz.com.

When the user uses his application, the the firewall sees the request to *.xyz.com and blocks it.

If we allow *.xyz.com then the application works.

Anyone have same experience? Any workaround without decryption?

BR,

Re: URL Filtering different with browser and application

BPry — Thu, 08 Nov 2018 14:37:20 GMT

@rjdahav163,

You need to do a wireshark or fiddler capture and see what URLs are actually being called by the application that the user is attempting to use. Fiddler is probably the best solution. IF you can't access the users machine directly for whatever reason create a specific policy for the user and assign a URL profile that has the action of Alert for all categories so that every visited URL will be logged by the firewall.

If you look at those logs I'm sure you'll fine additional URLs that you aren't allowing in your URL Filtering profile.

Re: URL Filtering different with browser and application

rjdahav163 — Tue, 13 Nov 2018 14:06:20 GMT

@BPry

I tried your solution with the Profile and Alert as action. In the logs we see the URL as --> *.xyz.com/

Dont know from where the / is coming? Really confused.

BR,

Re: URL Filtering different with browser and application

Raido_Rattameister — Tue, 13 Nov 2018 14:23:25 GMT

*.xyz.com comes probably from name on the certificate.

As you are not decrypting traffic then Palo can't see what comes after *.xyz.com/ and URL is logged with / at the end.

You are good if you whitelist *.xyz.com