topic Re: You don't have permission to access "http://www.costco.com/" on this server. in General Topics

You don't have permission to access "http://www.costco.com/" on this server.

fhewiufhwefhwe — Fri, 30 Jul 2021 16:56:06 GMT

There are certain websites that I cannot visit behind the firewall, and get errors saying You don't have permission to access XYZ on this server. In this case, I cannot visit www.costco.com

I am accessing with https/

Has anyone figured out how to resolve the issue? Do you have to disable SSL decryption for these sites or something else? I don't see denies under monitor -> traffic, same goes for url filtering.

Re: You don't have permission to access "http://www.costco.com/" on this server.

Remo — Fri, 30 Jul 2021 16:50:56 GMT

Hi @fhewiufhwefhwe

There is no issue on the firewall when accessing this website. The issue is on the website itself - they have a configuration problem with http. With https the website is loading without permission problems.

Re: You don't have permission to access "http://www.costco.com/" on this server.

jdelio — Fri, 30 Jul 2021 16:51:39 GMT

So, for any of this traffic, you are not seeing anything in your logs? Not for that rule? or anything? What about the packet capture? Have you tried to access the IP directly? Does the name resolve?

Re: You don't have permission to access "http://www.costco.com/" on this server.

fhewiufhwefhwe — Fri, 30 Jul 2021 17:00:45 GMT

The name resolves. I have not seen anything useful in the logs, and have been using PA for 3 years now. I have not checked a packet capture.

If I try by ipaddress, it says

Invalid URL

The requested URL "no URL", is invalid.

Reference #9.d6fb3f17.1627664346.330281c

Re: You don't have permission to access "http://www.costco.com/" on this server.

Remo — Fri, 30 Jul 2021 17:00:50 GMT

@fhewiufhwefhwe

Permission problems on websites are in about 99.9% (or even more) not an issue of the firewall.

Re: You don't have permission to access "http://www.costco.com/" on this server.

fhewiufhwefhwe — Fri, 30 Jul 2021 17:01:55 GMT

No, the attempt is with https and it does not load behind the firewall. I have no issues when not behind the firewall, but cannot test the same ipaddress since I am remote.

Re: You don't have permission to access "http://www.costco.com/" on this server.

fhewiufhwefhwe — Fri, 30 Jul 2021 17:08:07 GMT

Or it could be the response of other proxies or firewall to the palo alto having performed SSL decryption? I sometimes see sites that load for a second and then switch the permission denied. It's fairly annoying to tell people to browse sites from their phone.

Re: You don't have permission to access "http://www.costco.com/" on this server.

Remo — Fri, 30 Jul 2021 17:09:47 GMT

@fhewiufhwefhwe

Could you try to access the website now once again (try it in private mode or restart the browser)?

Re: You don't have permission to access "http://www.costco.com/" on this server.

fhewiufhwefhwe — Fri, 30 Jul 2021 17:12:22 GMT

It's working in edge. I wonder if it may have to do with blocking quic.

Re: You don't have permission to access "http://www.costco.com/" on this server.

Remo — Fri, 30 Jul 2021 17:14:51 GMT

@fhewiufhwefhwe

The operators of this website had an issue snd this is now resolved. At least this is what I see now after my tests. First I had the issue only with http but now it works correct and I am redirected to https. So I am still sure this one is not an issue of the firewall.

In similar cases it might be a geolocation restriction and because of that a permission error is shown...

Re: You don't have permission to access "http://www.costco.com/" on this server.

fhewiufhwefhwe — Fri, 30 Jul 2021 17:23:23 GMT

Not a clue given that it's working in Edge and not chrome, and works on chrome from other ipaddresses. Think I'll just try edge whenever I run into this, and maybe try clean installs of chrome. Quic and SSL decrypt are the only two ideas I have that are firewall related.