topic custom url category with non http and https port. in General Topics

custom url category with non http and https port.

DhananjayBhakte — Mon, 21 Sep 2020 06:15:36 GMT

HI,

I Have created custom URL category e.g category name (*.xyz.com) Now I want to create inbound rule like below.

Source zone :- Internet

Destination Zone :- LAN

Destination IP :- Any

Port :- 389 , 4172

URL Categary :- 'Custome category'

Security Profile : Any

My doubt is will this work on port 389 and 4172 port or this will work only on http and https port

Thanks

Dhananjay Bhakte

Re: custom url category with non http and https port.

Rene_Boehme — Mon, 21 Sep 2020 07:58:29 GMT

Hey,

could you please clarify what you are trying to achieve here? The application and the service are independend of each other. You can easily create a rule allowing SSL and Web-Browsing on port 389 and 4172.

Re: custom url category with non http and https port.

DhananjayBhakte — Mon, 21 Sep 2020 08:42:42 GMT

HI Rene,

I have requirement from customer to open port 389 and 4172 for eg *.xyz domain.

So I created custom category *.xyz.com and have to create rule by calling this category into rule and will allow only 389 and 4172 ports.

As far my understanding url category work only for ssl and web-browsing traffic, so just wanted to know if I keep url category in rule for port port 389 and 4172 will that rule work?

Thanks

Dhananjay

Re: custom url category with non http and https port.

Rene_Boehme — Mon, 21 Sep 2020 08:48:44 GMT

Hi,

ok now I got you. So you are correct URL filtering is working with http/https only. Futhermore it is kind of uncommon to have URL filtering active in inwards direction. So I saw the request for port 389 which is basically LDAP, dont know for 4172. However please make yourself familiar with the conecpt of an "application firewall" - we do not open ports anymore. But in term of customers request you are right, this is not going to work.

Re: custom url category with non http and https port.

aleksandar.astardzhiev — Mon, 21 Sep 2020 10:49:11 GMT

Hi @DhananjayBhakte ,

It sounds like you need FQDN not URL.

You can use FQDN object as source or destination address in the policy. Firewall will query the DNS server and use this fqdn to resolve it to IP address. The received IP will be cached for configured amount of time (probably 30min was the default, but not sure).

Given the port from your description it sound be more reasonable to use FQDN instead of URL filtering.

To be more precise URL custom category will work with web-based application. If you think for a bit it is logical - firewall needs to know which part of the traffic is the URL, so it doesn't matter what port you are using

Re: custom url category with non http and https port.

DhananjayBhakte — Mon, 21 Sep 2020 12:50:00 GMT

HI Alexzandar,

Traffic is not URL traffic and its application is not applicable.

For known fqdn e.g abc.xyz.com it is possible to write rule however fqdn is not fixed, customer says fqdn will change every time but domain (xyz.com) would be fixed, So my query is Can I allow wildcast *.xyz.com instead of single fqdn in security policy using custom url category for custom ports.?

Thanks

Dhananjay Bhakte

Re: custom url category with non http and https port.

couvertjy — Mon, 28 Sep 2020 04:07:44 GMT

@DhananjayBhakte wrote:
HI tellthebell

Traffic is not URL traffic and its application is not applicable.
For known fqdn e.g abc.xyz.com it is possible to write rule however fqdn is not fixed, customer says fqdn will change every time but domain (xyz.com) would be fixed, So my query is Can I allow wildcast *.xyz.com instead of single fqdn in security policy using custom url category for custom ports.?

Thanks
Dhananjay Bhakte

Given the port from your description it sound be more reasonable to use FQDN instead of URL filtering.

Re: custom url category with non http and https port.

DhananjayBhakte — Wed, 30 Sep 2020 13:43:45 GMT

HI Couvertjy,

Now I allow policy as below,

Source Zone :- Internet

Source IP address:- x.x.x.x

Destination Zone :- Lan

Destination IP address:- Any

Custom URL Categary :- *.xyz.com

Port :389 and 8759

Action : Allow

It is working, but my question is still there as *.xyz.com is hosted on internet so how can firewall allowing xyz.com fqdn to access ports on Lan zone through Custom URL category?. So here URL category is acting as source IP . So is it possible that custom url category can act as source or destination IP.

Thanks

Dhananjay Bhakte

Re: custom url category with non http and https port.

DhananjayBhakte — Wed, 30 Sep 2020 13:46:00 GMT

let me correct my below comment

Source IP also any

Source Zone :- Internet

Source IP address:- any

Destination Zone :- Lan

Destination IP address:- Any

Custom URL Categary :- *.xyz.com

Port :389 and 8759

Action : Allow

Re: custom url category with non http and https port.

DhananjayBhakte — Fri, 30 Jul 2021 13:13:16 GMT

HI,

In addition to above query, I got new requirement from customer as below

Source Zone : trust

Source user :- abc

Destination Zone :- Untrust(internet)

Destination :- *.ncra.tifr.res.in

Port : 22

Application: SSH

So to achieve above requirement , I have created custom url category as *.ncra.tifr.res.in and created rule as below.

Policy :--

Source Zone : trust

Source user :- abc

Destination Zone :- Untrust(internet)

Destination :- any

Port : 22

url category :- *. ncra.tifr.res.in

Application: SSH

Profile :- None

Action :- Allow

However it is not working.

Note :- Customer dont have fqdn he provided *.ncra.tifr.res.in

So I wanted to know that *.ncra.tifr.res.in custom category not work for application other than web browsing and ssl?

Thanks

Dhananjay

Re: custom url category with non http and https port.

Remo — Fri, 30 Jul 2021 19:33:45 GMT

Hi @DhananjayBhakte

Custom URL categories only work for http and TLS traffic - not only for apps web-browsing and ssl as there are quite a few more that are based on http/tls traffic - but at least for ssh you cannot use a custom URL category.

Re: custom url category with non http and https port.

DhananjayBhakte — Mon, 02 Aug 2021 03:48:53 GMT

Thanks Cyber Elite I Got it now......... 🙂

Re: custom url category with non http and https port.

S.Kaleem — Thu, 11 Dec 2025 12:39:22 GMT

so, what is the solution to define a policy for wildcard domain not fqdn on ports other than https?

something like this:

-----------------------------

Source Zone : trust

Source user :- abc

Destination Zone :- Untrust(internet)

Destination :- *. ncra.tifr.res.in

Port : 389,636

Profile :- None

Action :- Allow