URL filtering

[Nizmytom]

Hi All,

Hope all doing good.

When i access one of internet website PA categorize as ssl/443-allowed and one of the user accessing the same website PA categorize it as web browsing/80 and is blocked/Threat.

Why is it behaving this way? Is this issue with website or from source side.

Can someone please explain?

Traffic log- 443/ssl allowed and 80/web browsing blocked

Url filter same behavior.

Thank you for your support.

[Rajesh12]

@Nizmytom 

What is the internet URL name?

Also what does threat log shows for TCP 80 traffic, how does it categorized (Malware, virus etc..)?

Do you see any threat log for TCP 443 traffic?

Is the traffic of both 443 and 80 hitting same rule?

If hitting different rules, does both rules have same security profile groups/threat profiles applied or is there any difference?

[cfistik]

Are you sure the users are accessing the site using the same protocol, i.e. HTTP or HTTPS? Not all sites will redirect tcp/80 to tcp/443 but rather will answer on the  original port. This way one user may be accessing the site over HTTPS, while the other user over plain HTTP.

[RobinClayton]

If you get "web browsing/80" as blocked/Threat

then I would look first at what it thinks is a threat,

otherwise if it's allowing "ssl/443" and your not doing SSL Decryption then the above threat may be getting through undetected.

[Nizmytom]

This is the url: https://papirtigris.com/

We found it. It does not show us " categorize" is no solved. But its allowed in DC as well as branch but its not working only in branch so, we re-categorize it via cli and it started working.. But not sure why it did not show in traffic logs.

Thank you for all your help 🙂