03-10-2022 07:05 AM
I was curious if anyone knows why even when traffic is flagged as a threat by URL filtering there are still packets being sent and received?
03-10-2022 07:56 AM
Two reasons immediately spring to mind (as you didn't specify how many packets):
1) The HTTP/HTTPS session must setup and make the request before the PA can detect the URL being requested, so there will always be some packets before it is blocked. Additionally, multiple requests could be pipelined in an existing session, with the first allowed and a later request flagged.
2) The URL request is being alerted to, not reset/blocked. See whether the URL Filtering group it is detected under is set to Alert vs. Block.
03-10-2022 08:05 AM
Thanks for the response. The URL category is set to block.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
