We have a PA in 8.0.3, we have blocked adult URL category in this FW. WE are expecting that users can see adult webs.
For example: If a user tries to go to www.beeg.com, the main web is showed properly, but when user clicks on a video or any part in this web its being blocked. So why the main page is being showed???
In the logs we can see the sessions like allowed, but why PA is allowing this session if its a blocked URL adult category??
This is the log:
the TCP session always needs to be allow because it only reflects the tcp part of the session: the 3
way handshake and the http GET need to be allowed before layer7 inspection can kick in and inject a url blocking page (this is hijacking the existing established tcp session and replacing the resulting page with a blok page.
so the 'traffic' log will always be 'allow'
the url filtering action does state url-block as action, so there should be a block page and not the front page, are you certain the main page was not cached in the browser during experimentation?
I've just tested this exact site on my lab and get the block page immediately
Another thing to be aware of is that if this is a laptop the main page can have cached elements from off of your network where they were allowed to visit the page. We ran into this issue a few months ago where the user in question could get to a site which should have been blocked, because the user was accessing the site off of our network.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!