Internal users unable to access some banking URLs/Sites

[WinstonC]

I'm experiencing an issue with internal users unable to access some banking websites/URLs. Users can access these sites over the VPN (Global Protect) but can’t access these sites from the office/Internal.

I then created a URL Filtering category (added all the URLs in question) and attached it to a policy rule, also added these URLs to the SSL Decryption Exclusion. Decryption policy has also been created with no luck. Are you aware of any bug on Software Version 10.2.2-h2 running on PA-410. The challenge with PA-410 requires a Panorama to have full traffic logs visisbility.

[aleksandar.astardzhiev]

Hi @WinstonC ,

What troubleshooting you have performed to identify issue is caused by Palo Alto FW?

- What the user experience when try to open the problematic page? Timeout, block page, ssl error?

- What is the output of nslookup and ping commands against one of the problematic URLs?

- What traffic and URL logs on the firewall are showing for traffic to the problematic web sites?

- What is the difference in the rules that this traffic will match when users are behind FW and when they are connected to GlobalProtect?

- Are you apply any URL filtering? Have you check what URL category Palo is using for the problematic web sites? Is your URL filtering profile allowing this category?

PanOS 10.2 is still fairly new and it is completely normal to be full of weird bugs, but it is very wild guess to search for bug to be the root cause.