Problem URL-Filter onedrive urls

[RalfBoehm]

Hello everybody,

I use url-list from urlhaus. If I test some entries, I got a problem with onedrive-urls like this:

onedrive.live.com/download?cid=a75074ec168603e4&resid=a75074ec168603e4%21108&authkey=apnjueurszwr7fi

This url should be blocked by urlfilter on the firewall. But it was not blocked. I can download the file. Also I can not see any entries in url-filter-log. Thanks for any help or hints.

R. Boehm

[BPry]

@RalfBoehm,

Do you have decryption enabled for untrust traffic? 

[RalfBoehm]

No. Also I think, it is not relevant in this case. URL's are not encrypted. Normaly URL-Filter works for http- and https-traffic, independently of decryption. Or I am wrong?

[Remo · Accepted solution]

@RalfBoehm actually you are partly wrong. You are right that normally URL filtering works for http and https traffic, but configuration of tls decryption is required to see the full URL. Without decryption the firewall only sees "onedrive.live.com" and this obviously will not match with the url you wrote in the first post in this topic.

[RalfBoehm]

Thank you for your hint, I have configured decryption, and now it is worked as expected. But what is the reason for that difference? I thought, url is every time normaly text, and the URL-Filter compare exactly the called url?

MfG Boehm

[BPry]

@RalfBoehm,

Nope. Without decryption the only thing that the firewall can actually read is the domain in the ClientHello request, you can't see the full URL as the field is encrypted in HTTPS traffic.