topic google searched blocked in General Topics

google searched blocked

gvyskocil — Thu, 17 Sep 2020 12:48:39 GMT

I have an issue that seems to only be affecting one user. They seemingly randomly get the block page when doing a google search. Looking at logs most searches are allowed but then I will see the occasional block-url. I think I have narrowed it down to when chrome is opened the first search fails. Searching after that works ok. If I open a new chrome tab then gets blocked again on the first search. The home page is set to google.com. I tried explicitly setting it to https://www.google.com but same result. Any idea why just the first search is getting the block?

Re: google searched blocked

BPry — Thu, 17 Sep 2020 19:09:35 GMT

@gvyskocil,

What does the URL log actually say that denied the traffic?

Re: google searched blocked

gvyskocil — Fri, 25 Sep 2020 17:43:36 GMT

shows application google-base with an action of block-url for the url www.google.com/search. I had support take a look at it with me and they are not sure what is causing it. They believe something with the PC since it is only happening with one user. It's strange though, as long as you are using the same tab, the same search when done a second time works. Create a new browser window or tab and the first one is blocked. Subsequent search in that tab/windows work fine.

Re: google searched blocked

arvesynd — Thu, 29 Oct 2020 09:15:06 GMT

We're seeing a similar issue on PANOS 9.0.11 - traffic to Google.com searched first hits an IP address, which is being blocked due to the IP being classified as Unknown. After about 10-20 seconds of waiting, the user is redirected to Google, and no error message is shown to the end user.

In the URL Filtering log in the firewall web UI the category and category list for the IP address is search-engines and search-engines,low-risk. A URL test from the CLI lists the IP as unknown. The traffic is identified as google-base.

This started happening after upgrading from PANOS 8.1 to 9.0, and I have a theory that this is related to HTTP/2 inspection, which wasn't supported at 8.1.

A similar issue, PAN-137387, should've been resolved in 9.0.9: "Fixed an issue where URL filtering used the IP address instead of the hostname, which led to incorrect URL categorization."

Have anyone experienced the same on 9.0, and were you able to resolve it?

Re: google searched blocked

Chris.Crispino01 — Tue, 24 Nov 2020 13:52:32 GMT

I had the same issue. Support recommended upgrading to 9.1.3. I put a work around policy in to strip the ALPN for the search-engine category in the decryption policy.