- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
02-05-2023 06:51 PM
Hi All,
I have been experiencing a situation where http and https traffic are getting hits on 1 of my security policies which is configured with Custom URL Category.
It looks something like this:
Source Zone: Internal
Source: Internal Network
Destination Zone: External
Destination: Any
Application: Any
Service: HTTP & HTTPS
URL Category: *.testing.com & testing.com
I have seen several discussions pertaining to similar issues but none of them are really the same. On traffic logs I am seeing application as insufficient-data, incomplete and being resolved to SSL / web-browsing.
I am hesitant to disable the rule as this device is serving a large amount of users and I do not wish to disrupt internet connectivity.
02-06-2023 07:03 AM
Whenever you use categories as match criteria, the first such rule will get hit in the rulebase as the firewall has to allow enough traffic to pass to see what the domain is going to be. Once it can actually identify the domain in question, it'll continue through the rulebase as you'd expect to verify if there's a matching entry.
02-06-2023 09:22 AM
Hi @BPry ,
Would the best approach to this situation be tightening down the rule with FQDN objects rather than URL category?
As I have mentioned, there are actually a huge load of traffic that passes through this security rule and I am seeing tcp-fin for session end even for those mismatched URLs.
This is concerning as it would mean that sessions are being established with this rule and it is not supposed to be the case. This is a legacy rule that was migrated from CISCO ASA and we are looking to retain it as part of user's requirement.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!