For details on cookie usage on our site, read our Privacy Policy
Unexpected behaviour URl filtering web
- LIVEcommunity
- Discussions
- General Topics
- Unexpected behaviour URl filtering web
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
- Mark as New
- Subscribe to RSS Feed
- Permalink
08-06-2018 12:46 AM
Hi,
We are having a unexpected behaviour with PA identifying a web:
"rose.pharmaintelligence.informa.com"
This web is categorize like "news". We have in our URL profile "continue". But we are seeing that this web is being denied with reason "policy deny". Why PA is not allowing this web?
Accepted Solutions
- Mark as New
- Subscribe to RSS Feed
- Permalink
08-06-2018 03:02 AM
The URL I posted describes a way to serve the resonse page to users without TLS decryption.
The firewall is able to see the URL - at least the FQDN - in the TLS handshake even without decryption. But by default the firewall is not able to inject the response page into this connection as this is only possible when the firewall sees the actual http traffic. So try the solution in the url and hopefully this will solve the issue for you/your customer.
- Mark as New
- Subscribe to RSS Feed
- Permalink
08-06-2018 01:03 AM
It would be helpful to see the full traffic log, fields such as the session end reason etc.
Do you have HTTPS inspection activated?
Do you see the continue page?
Does continue work for other HTTPS sites?
Does the site use certificate pinning?
- Mark as New
- Subscribe to RSS Feed
- Permalink
08-06-2018 01:30 AM - edited 08-06-2018 02:00 AM
With almost 100% certainty, this is because of TLS decryption. What pan-os version are you using?
The issue here could be related to the fact that this site already supports TLS1.3 and the firewall somehow does not understand the TLS handshake correctly even if a connection with TLS1.2 is still possible.
Try to configure a decryption exception to check if it then works. But anyway, in this case I would recommend to open a TAC case.
- Mark as New
- Subscribe to RSS Feed
- Permalink
08-06-2018 01:36 AM - edited 08-06-2018 01:45 AM
When end-customer access to this web by https received a security event about security stuff. So customer delete https, and put http so the continue web is showed.
No decrypt ssl policy in the FW
PanOs is 8.0.3
- Mark as New
- Subscribe to RSS Feed
- Permalink
08-06-2018 02:35 AM
In this case it is at least related to TLS decryption. Without TLS decryption configured the firewall is not able to inject the continue page and because of that you probably have this traffic log entry when users go directly to the encrypted version of the website.
When the users manually enter http:// then as you wrote the users are able to see the continue page and continue also to the website right?
- Cortex XDR PoC Lab ft. CVE-2021-3560 in Cortex XDR Discussions
- Why does URL Filtering Profile with a custom URL Category assigned require the same custom URL category assigned in a security rule to work? in General Topics
- Unexpected behaviour in security policy in General Topics
- TCP issues when moving an application through a Palo Alto FW in General Topics
- Experience with migration to PAN-OS 9 regarding URL filtering changes in General Topics
Show your appreciation!
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
