Hope all doing good.
When i access one of internet website PA categorize as ssl/443-allowed and one of the user accessing the same website PA categorize it as web browsing/80 and is blocked/Threat.
Why is it behaving this way? Is this issue with website or from source side.
Can someone please explain?
Traffic log- 443/ssl allowed and 80/web browsing blocked
Url filter same behavior.
Thank you for your support.
What is the internet URL name?
Also what does threat log shows for TCP 80 traffic, how does it categorized (Malware, virus etc..)?
Do you see any threat log for TCP 443 traffic?
Is the traffic of both 443 and 80 hitting same rule?
If hitting different rules, does both rules have same security profile groups/threat profiles applied or is there any difference?
Are you sure the users are accessing the site using the same protocol, i.e. HTTP or HTTPS? Not all sites will redirect tcp/80 to tcp/443 but rather will answer on the original port. This way one user may be accessing the site over HTTPS, while the other user over plain HTTP.
If you get "web browsing/80" as blocked/Threat
then I would look first at what it thinks is a threat,
otherwise if it's allowing "ssl/443" and your not doing SSL Decryption then the above threat may be getting through undetected.
This is the url: https://papirtigris.com/
We found it. It does not show us " categorize" is no solved. But its allowed in DC as well as branch but its not working only in branch so, we re-categorize it via cli and it started working.. But not sure why it did not show in traffic logs.
Thank you for all your help
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!