topic URL filtering in General Topics

URL filtering

Nizmytom — Tue, 07 Jan 2020 04:40:34 GMT

Hi All,

Hope all doing good.

When i access one of internet website PA categorize as ssl/443-allowed and one of the user accessing the same website PA categorize it as web browsing/80 and is blocked/Threat.

Why is it behaving this way? Is this issue with website or from source side.

Can someone please explain?

Traffic log- 443/ssl allowed and 80/web browsing blocked

Url filter same behavior.

Thank you for your support.

Re: URL filtering

Rajesh12 — Tue, 07 Jan 2020 07:17:47 GMT

@Nizmytom

What is the internet URL name?

Also what does threat log shows for TCP 80 traffic, how does it categorized (Malware, virus etc..)?

Do you see any threat log for TCP 443 traffic?

Is the traffic of both 443 and 80 hitting same rule?

If hitting different rules, does both rules have same security profile groups/threat profiles applied or is there any difference?

Re: URL filtering

cfistik — Wed, 08 Jan 2020 21:01:31 GMT

Are you sure the users are accessing the site using the same protocol, i.e. HTTP or HTTPS? Not all sites will redirect tcp/80 to tcp/443 but rather will answer on the original port. This way one user may be accessing the site over HTTPS, while the other user over plain HTTP.

Re: URL filtering

RobinClayton — Thu, 09 Jan 2020 16:41:09 GMT

If you get "web browsing/80" as blocked/Threat

then I would look first at what it thinks is a threat,

otherwise if it's allowing "ssl/443" and your not doing SSL Decryption then the above threat may be getting through undetected.

Re: URL filtering

Nizmytom — Fri, 10 Jan 2020 11:03:55 GMT

This is the url: https://papirtigris.com/

We found it. It does not show us " categorize" is no solved. But its allowed in DC as well as branch but its not working only in branch so, we re-categorize it via cli and it started working.. But not sure why it did not show in traffic logs.

Thank you for all your help 🙂