Problem with URL Filtering

[H.Sutanto]

Hi,

I have an issue with PAN URL Filtering, where I still able to access website that has been blocked.

For example:

If I open http (http://nanime.live) the website is blocked

But if I open using https, website can be accessed

When I check on monitor -- logs -- url filtering, nanime.live is blocked

Please your help

Thank you

[reaper]

can you try running the developer tools > network in your browser, to see what is being let though?

(did you make sure your browser cache has been cleared)

[jfernandez1 · Accepted solution]

Hello Friend!

URL filtering works different when using HTTP or HTTPS, since some payload might be encrypted or not, on the following KB you can find the reasons behind each behavior: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HAL0

Mark this comment as solution if you think this information is useful for you

[H.Sutanto]

yes, i have try running the developer tools

left (using http) and right using https

[reaper]

if you access that website and look at the certificate, it appears that the certificate is reflecting a different URL (laznasphr.kilatdigital.com), which could be why the connection is seemingly being allowed

In SSL connections, URL filtering uses the certificate SNI instead of the HTTP GET

[H.Sutanto]

I tried to access another website moenime.com, when I check the hostname certificate same as the URL, but still can be accessed.

please your advice.

[reaper]

what does your logging report? Are you hitting a different rule, is the website reported as a different URL/category?