topic Re: Custom URL Category issue in General Topics

Custom URL Category issue

FarzanaMustafa — Wed, 16 Oct 2019 09:36:15 GMT

Hello,

We have followed this guide:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIPCA0

Decrypt portion is working well. However we are finding the custom category and its contents although set to block, are not blocking https unless its in the block override.

Example url HTTP results in below block: Correct categorisation block

HTTPS version of the same url (although decrypted) gets blocked by the override block-list from the catchall policy I have in place.

Re: Custom URL Category issue

BPry — Wed, 16 Oct 2019 17:55:05 GMT

@FarzanaMustafa,

Look at your system logs and verify that you are actually hitting the proper security policy where the URL category is applied. If you are not, then please post the entry you are actually trying to map on and the URL that isn't being caught.

Re: Custom URL Category issue

FarzanaMustafa — Fri, 25 Oct 2019 04:51:56 GMT

Hi @BPry

Thank you for the response. We were able to make it work by changing the Service type to 'any' instead of 'application-default'.

However, this is not good as it allows app-ids to high risk profiles.

What is the best practice to structure our rules below?

Re: Custom URL Category issue

BPry — Fri, 25 Oct 2019 20:47:57 GMT

@FarzanaMustafa,

I'd really need to take a look at your application filters and see what applications they are matching to be sure; but when you start decrypting traffic one of the primary issues you'll run across is that web-browsing will map to tcp-443 (due to decryption) and that doesn't work with application-default policies.

I would try your same policy, but make a subsequent policy that allows web-browsing on service object service-https and see if that doesn't fix the issues that you were running into without the 'any' policy.

Re: Custom URL Category issue

FarzanaMustafa — Thu, 31 Oct 2019 02:09:45 GMT

@BPry

Thank you for your help.

Noticing the destination nat port, we modified the security policy to be App-id = web-browsing and Service = custom service group of port 80 and 443. This appears to have resolve the issue.