You don't have permission to access "http://www.costco.com/" on this server.

[fhewiufhwefhwe]

There are certain websites that I cannot visit behind the firewall, and get errors saying You don't have permission to access XYZ on this server.  In this case, I cannot visit www.costco.com

I am accessing with https/

Has anyone figured out how to resolve the issue?   Do you have to disable SSL decryption for these sites or something else?  I don't see denies under monitor -> traffic, same goes for url filtering.

[Remo]

Hi @fhewiufhwefhwe 

There is no issue on the firewall when accessing this website. The issue is on the website itself - they have a configuration problem with http. With https the website is loading without permission problems.

[jdelio]

So, for any of this traffic, you are not seeing anything in your logs?  Not for that rule? or anything?  What about the packet capture? Have you tried to access the IP directly? Does the name resolve? 

[fhewiufhwefhwe]

The name resolves.  I have not seen anything useful in the logs, and have been using PA for 3 years now.  I have not checked a packet capture.

If I try by ipaddress, it says 

Invalid URL

The requested URL "no URL", is invalid.

Reference #9.d6fb3f17.1627664346.330281c

[Remo]

@fhewiufhwefhwe 

Permission problems on websites are in about 99.9% (or even more) not an issue of the firewall.

[fhewiufhwefhwe]

No, the attempt is with https and it does not load behind the firewall.  I have no issues when not behind the firewall, but cannot test the same ipaddress since I am remote.

[fhewiufhwefhwe]

Or it could be the response of other proxies or firewall to the palo alto having performed SSL decryption?   I sometimes see sites that load for a second and then switch the permission denied.  It's fairly annoying to tell people to browse sites from their phone.

[Remo]

@fhewiufhwefhwe 

Could you try to access the website now once again (try it in private mode or restart the browser)?

[fhewiufhwefhwe]

It's working in edge.  I wonder if it may have to do with blocking quic.

[Remo · Accepted solution]

@fhewiufhwefhwe 

The operators of this website had an issue snd this is now resolved. At least this is what I see now after my tests. First I had the issue only with http but now it works correct and I am redirected to https. So I am still sure this one is not an issue of the firewall.

In similar cases it might be a geolocation restriction and because of that a permission error is shown...

[fhewiufhwefhwe]

Not a clue given that it's working in Edge and not chrome, and works on chrome from other ipaddresses.  Think I'll just try edge whenever I run into this, and maybe try clean installs of chrome.  Quic and SSL decrypt are the only two ideas I have that are firewall related.