Have a site being blocked I cannot seem to unblock

[JeffTQT]

I am having an issue where just a download for a printer driver is being blocked but cannot get it to be let through and need some help.

The site is ricoh.com and we can get there no problem. You can navigate the site as well but when you find the download you need and click it you get a web page blocked page. It points me to one of our custom URL catgories. On the firewall everything under traffic monitor is being allowed. I only see the block under monitor/URL filtering. I have gone into our custom URL category and allowed the site. The problem is the site itself is being allowed. I even tried adding the entire URL to the allowed list under the URL filtering profile and no change. Added it to the URL category to be allowed, no change. I am at a loss at this point. Any ideas?

[Phoenix · Accepted solution]

Hello jeffthpinc

I see you have tried to troubleshoot in the right direction, I have something more.

1> First identify if it is Url block page or app block page and so on to see if its URL engine blocking or App engine.

2> Once narrowed down as URL, we can go ahead and see what rule or category it is indicating as done by you. Now even after it is blocking when put in allow list, this explains there is some other category or so which is blocking it.

When we see URL logs and a block action for download, what do we see when we click on the magnified icon on that log line ? What is the rule, category ? Have we verified if this rule has the URL profile with Allow list ?

3> Is there any threat logs for this action, just to verify if the PAN does not detect this as threat and block it.

Thanks

[JeffTQT]

Ok took a look and found that it was using a custom URL profile but blocking under a different category than I would have expected. I had added the URL to the category but to get the download had to add the complete URL to the allow list under the other profile. Thanks for the help.