Traffic getting hits on non-allowed URLs

[KelvynYeo]

Hi All,

I have been experiencing a situation where http and https traffic are getting hits on 1 of my security policies which is configured with Custom URL Category.

It looks something like this:

Source Zone: Internal

Source: Internal Network

Destination Zone: External

Destination: Any

Application: Any

Service: HTTP & HTTPS

URL Category: *.testing.com & testing.com

I have seen several discussions pertaining to similar issues but none of them are really the same. On traffic logs I am seeing application as insufficient-data, incomplete and being resolved to SSL / web-browsing.

I am hesitant to disable the rule as this device is serving a large amount of users and I do not wish to disrupt internet connectivity.

[BPry]

@KelvynYeo,

Whenever you use categories as match criteria, the first such rule will get hit in the rulebase as the firewall has to allow enough traffic to pass to see what the domain is going to be. Once it can actually identify the domain in question, it'll continue through the rulebase as you'd expect to verify if there's a matching entry.

[KelvynYeo]

Hi @BPry ,

Would the best approach to this situation be tightening down the rule with FQDN objects rather than URL category?

As I have mentioned, there are actually a huge load of traffic that passes through this security rule and I am seeing tcp-fin for session end even for those mismatched URLs.

This is concerning as it would mean that sessions are being established with this rule and it is not supposed to be the case. This is a legacy rule that was migrated from CISCO ASA and we are looking to retain it as part of user's requirement.