Wetransfer download site we.tl not seen as Wetransfer application

[ZEBIT]

I have created a rule which allow the wetransfer (download and upload) application.

But when a user receive an email to download a file the url is we.tl/random numbers.

When the user clicks it the firewall doesn't see it as the application wetransfer-download but as category online storage and backup.

Is this a bug in the Pan-OS and how can we solve this?

[BPry]

@ZEBIT,

I don't use Wetransfer so I can't speak to the accuracy of the App-ID, but just to confirm, are you decrypting the traffic? If you are and it's still not registering properly, you can submit it to TAC to request the existing ID be modified to capture the traffic properly.

[ZEBIT]

Yeah we are decrypting the traffic. But doesn't get recognized as the correct app-id.

The link that get's opened is download.wetransfer.com/

The problem is that the app-id is wetransfer downloading which is allowed, but the url download.wetransfer.com is in the URL categorie online backup and storage and that is a block categorie in our environment. So one rule is over rulling the other one.

[BPry]

@ZEBIT so the app-id is getting recorded correctly, or it isn't? You are likely just running into an order of operations issue honestly. IE: If you are blocking the URL category the firewall may not be able to classify the traffic properly before the traffic is identified as online backup and storage and dropped by whatever rule you have denying that traffic. 

[ZEBIT]

@BPry I have rules which allows app like wetransfer download and no URL filtering. After this rule I have a rule with URL filtering.

When we we hit the site download.wetransfer.com the app rule doesn't get hit but the URL filtering rule. 

After allowing the category online storage and backup the site get recognized as wetransfer-download.

[aleksandar.astardzhiev]

Hi @ZEBIT ,

I would say the problem is not with the app-id signature, but how networks work...

When you visit the download page and browser create new HTTP connection firewall will first see the TCP connection, then the SSL neogtiation and only after that the actual data. As you can imagine FW need some amount of packets to pass in order to categorize the application. So even that your wetransfer app rule is above, for the first couple of packets FW will not match this rule (because it will identify it as application = web-browsing/ssl), so it will match our generic web browsing rule (the one with url filtering).

FW will be able to categorize the URL and therefore take the action base on your url filtering profile. If it is allowed more traffic will start passing over the FW so the app-id engine will have enough data to detect that it is actually wetranfer and not the generic web-browsing. In that moment FW will make another policy lookup (because the app has changes) and now it will match your wetransfer specific rule.

I guess you can try to submit request for app optimisation so the wetransfer app signature match earlier (but not sure if that is possible)

What you could do is:

- Create custom URL category and add wetransfer domain (with wildcard or specific subdomains you choose)

- Go to your URL filtering profile and choose alert/allow for the category you create above

This will create whitelist only for the wetransfer while you still block "online storage and backup" category

[QuentinH]

Hey @ZEBIT ,

Have you found a solution to this problem ?

[ZEBIT]

@QuentinH 

Yeah we found a solution.

We created an application group with the file sharing apps we allow. This is wetransfer and google drive.

After that I created a policy rule called File sharing app, allowed the users who may use these apps, set the Application to the application group we created and in the URL filtering we allowed the category online storage and backup. We created a seperate URL filtering for this policy rule.

[QuentinH]

hey @ZEBIT  ,

So you allowed the "Online-storage-and-backup" category?
Then you have created a rule to allow wetransfer upload urls or you have created a rule to block download urls,

Please can you describe the process you used?

[ZEBIT · Accepted solution]

@QuentinH 

Yeah we found a solution.

We created an application group with the file sharing apps we allow. This is wetransfer and google drive.

After that I created a policy rule called File sharing app, allowed the users who may use these apps, set the Application to the application group we created and in the URL filtering we allowed the category online storage and backup. We created a seperate URL filtering for this policy rule.