Wetransfer download site we.tl not seen as Wetransfer application

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Wetransfer download site we.tl not seen as Wetransfer application

L3 Networker

I have created a rule which allow the wetransfer (download and upload) application.

But when a user receive an email to download a file the url is we.tl/random numbers.

When the user clicks it the firewall doesn't see it as the application wetransfer-download but as category online storage and backup.

Is this a bug in the Pan-OS and how can we solve this?

1 accepted solution

Accepted Solutions

@QuentinH 

Yeah we found a solution.

We created an application group with the file sharing apps we allow. This is wetransfer and google drive.

After that I created a policy rule called File sharing app, allowed the users who may use these apps, set the Application to the application group we created and in the URL filtering we allowed the category online storage and backup. We created a seperate URL filtering for this policy rule.

View solution in original post

9 REPLIES 9

Cyber Elite
Cyber Elite

@ZEBIT,

I don't use Wetransfer so I can't speak to the accuracy of the App-ID, but just to confirm, are you decrypting the traffic? If you are and it's still not registering properly, you can submit it to TAC to request the existing ID be modified to capture the traffic properly.

Yeah we are decrypting the traffic. But doesn't get recognized as the correct app-id.

The link that get's opened is download.wetransfer.com/

 

The problem is that the app-id is wetransfer downloading which is allowed, but the url download.wetransfer.com is in the URL categorie online backup and storage and that is a block categorie in our environment. So one rule is over rulling the other one.

@ZEBIT so the app-id is getting recorded correctly, or it isn't? You are likely just running into an order of operations issue honestly. IE: If you are blocking the URL category the firewall may not be able to classify the traffic properly before the traffic is identified as online backup and storage and dropped by whatever rule you have denying that traffic. 

@BPry I have rules which allows app like wetransfer download and no URL filtering. After this rule I have a rule with URL filtering.

When we we hit the site download.wetransfer.com the app rule doesn't get hit but the URL filtering rule. 

After allowing the category online storage and backup the site get recognized as wetransfer-download.

Hi @ZEBIT ,

I would say the problem is not with the app-id signature, but how networks work...

When you visit the download page and browser create new HTTP connection firewall will first see the TCP connection, then the SSL neogtiation and only after that the actual data. As you can imagine FW need some amount of packets to pass in order to categorize the application. So even that your wetransfer app rule is above, for the first couple of packets FW will not match this rule (because it will identify it as application = web-browsing/ssl), so it will match our generic web browsing rule (the one with url filtering).

FW will be able to categorize the URL and therefore take the action base on your url filtering profile. If it is allowed more traffic will start passing over the FW so the app-id engine will have enough data to detect that it is actually wetranfer and not the generic web-browsing. In that moment FW will make another policy lookup (because the app has changes) and now it will match your wetransfer specific rule.

 

I guess you can try to submit request for app optimisation so the wetransfer app signature match earlier (but not sure if that is possible)

 

What you could do is:

- Create custom URL category and add wetransfer domain (with wildcard or specific subdomains you choose)

- Go to your URL filtering profile and choose alert/allow for the category you create above

This will create whitelist only for the wetransfer while you still block "online storage and backup" category

 

 

L1 Bithead

Hey @ZEBIT ,

Have you found a solution to this problem ?

 

 

@QuentinH 

Yeah we found a solution.

We created an application group with the file sharing apps we allow. This is wetransfer and google drive.

After that I created a policy rule called File sharing app, allowed the users who may use these apps, set the Application to the application group we created and in the URL filtering we allowed the category online storage and backup. We created a seperate URL filtering for this policy rule.

hey @ZEBIT  ,

So you allowed the "Online-storage-and-backup" category?
Then you have created a rule to allow wetransfer upload urls or you have created a rule to block download urls,

Please can you describe the process you used?

@QuentinH 

Yeah we found a solution.

We created an application group with the file sharing apps we allow. This is wetransfer and google drive.

After that I created a policy rule called File sharing app, allowed the users who may use these apps, set the Application to the application group we created and in the URL filtering we allowed the category online storage and backup. We created a seperate URL filtering for this policy rule.

  • 1 accepted solution
  • 7995 Views
  • 9 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!