Rule works at one site but not another

[mmeiklejohn]

Hi All,

I have a rule to block TikTok at a school and it works as expected.  I have another rule to block TikTok at another school and it does not work at all.  The rules are identical except that the first rule blocks some other apps as well.

I've attached screenshots.  Rule1 and Log1 are for the site that works, Rule 2 and Log 2 are for the site that doesn't work. 

Pulling my hair out on this one!  Does anyone have any suggestions?

Thanks for your time.

Marlon

[TomYoung]

Hi @mmeiklejohn ,

Since TikTok is hitting LAN-INT-Allow-Sanctioned Apps, 1st verify your block rule comes before it.

Second, compare each column in the traffic log with rule (e.g., does the source IP match one of the source groups configured?).  If the order of rules is correct, there WILL be some detail in the traffic logs that does not match the rule.  Otherwise, it would match.

Thanks,

Tom

[mmeiklejohn]

Thanks for the input Tom.  I confirmed the blocking rules before the LAN-INT-Allow-Sanctioned-Apps, and the IPs of the machines in question were part of the assigned source groups.

However, I discovered that I had a URL Category defined under the Service/URL Category tab on the blocking rule that was failing.  The URL Category defined specific URLs that were to be blocked, so I was attempting to block apps and URLs in the same rule.  For the blocking rule that WAS working, I did not have any URL Categories defined.  In that case I had a totally separate rule to block specified URLs.  I don't fully understand why that would cause the rule to fail, but I don't really care at this point.  All is working as expected now! 

[brramirez]

@mmeiklejohn are your rules still working?  I just had to add some cdn urls for tiktok.  Traffic in andriod and apple apps was being allowed.

[mmeiklejohn]

Hi.  I'm told that once in a while a student will get through on an iPad, but I've never been able to confirm that.