topic Re: EDL blocking URL in General Topics

EDL blocking URL

BigPalo — Thu, 26 Aug 2021 10:37:07 GMT

We have a feed for ELD in Palo Alto. We realised that we add this URL (https://unrealengine.com) this web is been blocked properly, but not "https://unrealengine.com/en-US/donwload.

For example, www.unrealengine.com. The URL part does not block the URI part either, only if you add it as a domain (without the URI part), it blocks effectively.

it could be anything related to https decrypt SSL needed?

Re: EDL blocking URL

ShaiW — Thu, 26 Aug 2021 12:16:14 GMT

Yes, this is related to SSL decryption. The firewall can see HTTPS the connection from client to server and detect the server address via certificate CN or SNI values and these do not yet contain the URI part. A few packets later, when TLS session is set up the GET request will be sent with the URI - and this you'll only be able to see if you do decryption.

Hope this helps,

Shai

Re: EDL blocking URL

aleksandar.astardzhiev — Thu, 26 Aug 2021 12:55:37 GMT

Hi @BigPalo ,

What @ShaiW explained is correct, but it is only one part of your problem. I would say the main reason for your issues is how you have defined the URL in the EDL.

Lets break into to pieces:

- Your EDL contain only the domain "unrealengine.com", but this way any sub-domain will not match - this is not specific for PAN FWs, this is how domain and sub-domains works. If you want to block/allow URLs for the domain and any sub-domain you need to have two entries - "unrealengine.com" and "*.unrealengine.com"

- As @ShaiW already explained, if you don't perform SSL decryption firewall actually will never see the full URL. So the URL filtering feature will use the SSL certificate to determine which URL you are trying to reach. And because the SSL contain only the hostname (not the full URL), you can only filter based on domains and sub-domains. So you can still apply URL filtering, but without the complete control of the URI

Re: EDL blocking URL

LAYER_8 — Thu, 26 Aug 2021 16:30:16 GMT

To add to some of the URL Filtering wildcard behavior discussed above, please see previous posts like this one.