Wetransfer download site we.tl not seen as Wetransfer application

[ZEBIT]

I have created a rule which allow the wetransfer (download and upload) application.

But when a user receive an email to download a file the url is we.tl/random numbers.

When the user clicks it the firewall doesn't see it as the application wetransfer-download but as category online storage and backup.

Is this a bug in the Pan-OS and how can we solve this?

[Astardzhiev]

Hi @ZEBIT ,

I would say the problem is not with the app-id signature, but how networks work...

When you visit the download page and browser create new HTTP connection firewall will first see the TCP connection, then the SSL neogtiation and only after that the actual data. As you can imagine FW need some amount of packets to pass in order to categorize the application. So even that your wetransfer app rule is above, for the first couple of packets FW will not match this rule (because it will identify it as application = web-browsing/ssl), so it will match our generic web browsing rule (the one with url filtering).

FW will be able to categorize the URL and therefore take the action base on your url filtering profile. If it is allowed more traffic will start passing over the FW so the app-id engine will have enough data to detect that it is actually wetranfer and not the generic web-browsing. In that moment FW will make another policy lookup (because the app has changes) and now it will match your wetransfer specific rule.

I guess you can try to submit request for app optimisation so the wetransfer app signature match earlier (but not sure if that is possible)

What you could do is:

- Create custom URL category and add wetransfer domain (with wildcard or specific subdomains you choose)

- Go to your URL filtering profile and choose alert/allow for the category you create above

This will create whitelist only for the wetransfer while you still block "online storage and backup" category

[QuentinH]

Hey @ZEBIT ,

Have you found a solution to this problem ?

[ZEBIT]

@QuentinH 

Yeah we found a solution.

We created an application group with the file sharing apps we allow. This is wetransfer and google drive.

After that I created a policy rule called File sharing app, allowed the users who may use these apps, set the Application to the application group we created and in the URL filtering we allowed the category online storage and backup. We created a seperate URL filtering for this policy rule.

[QuentinH]

hey @ZEBIT  ,

So you allowed the "Online-storage-and-backup" category?
Then you have created a rule to allow wetransfer upload urls or you have created a rule to block download urls,

Please can you describe the process you used?

[ZEBIT · Accepted solution]

@QuentinH 

Yeah we found a solution.

We created an application group with the file sharing apps we allow. This is wetransfer and google drive.

After that I created a policy rule called File sharing app, allowed the users who may use these apps, set the Application to the application group we created and in the URL filtering we allowed the category online storage and backup. We created a seperate URL filtering for this policy rule.