Problem URL-Filter onedrive urls

Reply
Highlighted
L2 Linker

Problem URL-Filter onedrive urls

Hello everybody,

 

I use url-list from urlhaus. If I test some entries, I got a problem with onedrive-urls like this:

 

onedrive.live.com/download?cid=a75074ec168603e4&resid=a75074ec168603e4%21108&authkey=apnjueurszwr7fi

This url should be blocked by urlfilter on the firewall. But it was not blocked. I can download the file. Also I can not see any entries in url-filter-log. Thanks for any help or hints.

 

R. Boehm


Accepted Solutions
Highlighted
Cyber Elite

@R.Boehm actually you are partly wrong. You are right that normally URL filtering works for http and https traffic, but configuration of tls decryption is required to see the full URL. Without decryption the firewall only sees "onedrive.live.com" and this obviously will not match with the url you wrote in the first post in this topic.

View solution in original post


All Replies
Highlighted
Cyber Elite

@R.Boehm,

Do you have decryption enabled for untrust traffic? 

Highlighted
L2 Linker

No. Also I think, it is not relevant in this case. URL's are not encrypted. Normaly URL-Filter works for http- and https-traffic, independently of decryption. Or I am wrong?

Highlighted
Cyber Elite

@R.Boehm actually you are partly wrong. You are right that normally URL filtering works for http and https traffic, but configuration of tls decryption is required to see the full URL. Without decryption the firewall only sees "onedrive.live.com" and this obviously will not match with the url you wrote in the first post in this topic.

View solution in original post

Highlighted
L2 Linker

Thank you for your hint, I have configured decryption, and now it is worked as expected. But what is the reason for that difference? I thought, url is every time normaly text, and the URL-Filter compare exactly the called url?

 

MfG Boehm

Highlighted
Cyber Elite

@R.Boehm,

Nope. Without decryption the only thing that the firewall can actually read is the domain in the ClientHello request, you can't see the full URL as the field is encrypted in HTTPS traffic. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!