Adult category not being blocked

[soporteseguridad]

Hi,

We have a PA in 8.0.3, we have blocked adult URL category in this FW. WE are expecting that users can see adult webs.

For example: If a user tries to go to www.beeg.com, the main web is showed properly, but when user clicks on a video or any part in this web its being blocked. So why the main page is being showed???

In the logs we can see the sessions like allowed, but why PA is allowing this session if its a blocked URL adult category??

This is the log:

[reaper]

the TCP session always needs to be allow because it only reflects the tcp part of the session: the 3

way handshake and the http GET need to be allowed before layer7 inspection can kick in and inject a url blocking page (this is hijacking the existing established tcp session and replacing the resulting page with a blok page.

so the 'traffic' log will always be 'allow'

the url filtering action does state url-block as action, so there should be a block page and not the front page, are you certain the main page was not cached in the browser during experimentation?

I've just tested this exact site on my lab and get the block page immediately

 

[BPry]

@soporteseguridad,

Another thing to be aware of is that if this is a laptop the main page can have cached elements from off of your network where they were allowed to visit the page. We ran into this issue a few months ago where the user in question could get to a site which should have been blocked, because the user was accessing the site off of our network.