topic Problem URL-Filter onedrive urls in General Topics

Problem URL-Filter onedrive urls

RalfBoehm — Fri, 31 Jul 2020 11:33:32 GMT

Hello everybody,

I use url-list from urlhaus. If I test some entries, I got a problem with onedrive-urls like this:

onedrive.live.com/download?cid=a75074ec168603e4&resid=a75074ec168603e4%21108&authkey=apnjueurszwr7fi

This url should be blocked by urlfilter on the firewall. But it was not blocked. I can download the file. Also I can not see any entries in url-filter-log. Thanks for any help or hints.

R. Boehm

Re: Problem URL-Filter onedrive urls

BPry — Fri, 31 Jul 2020 20:30:02 GMT

@RalfBoehm,

Do you have decryption enabled for untrust traffic?

Re: Problem URL-Filter onedrive urls

RalfBoehm — Tue, 04 Aug 2020 06:26:32 GMT

No. Also I think, it is not relevant in this case. URL's are not encrypted. Normaly URL-Filter works for http- and https-traffic, independently of decryption. Or I am wrong?

Re: Problem URL-Filter onedrive urls

Remo — Tue, 04 Aug 2020 11:26:14 GMT

@RalfBoehm actually you are partly wrong. You are right that normally URL filtering works for http and https traffic, but configuration of tls decryption is required to see the full URL. Without decryption the firewall only sees "onedrive.live.com" and this obviously will not match with the url you wrote in the first post in this topic.

Re: Problem URL-Filter onedrive urls

RalfBoehm — Fri, 07 Aug 2020 13:33:46 GMT

Thank you for your hint, I have configured decryption, and now it is worked as expected. But what is the reason for that difference? I thought, url is every time normaly text, and the URL-Filter compare exactly the called url?

MfG Boehm

Re: Problem URL-Filter onedrive urls

BPry — Fri, 07 Aug 2020 13:46:04 GMT

@RalfBoehm,

Nope. Without decryption the only thing that the firewall can actually read is the domain in the ClientHello request, you can't see the full URL as the field is encrypted in HTTPS traffic.