Problem with URL Filtering

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Problem with URL Filtering

L1 Bithead

Hi,

 

I have an issue with PAN URL Filtering, where I still able to access website that has been blocked.

For example:

If I open http (http://nanime.live) the website is blocked

HSutanto_1-1714366986711.png

But if I open using https, website can be accessed

HSutanto_2-1714367115004.png

When I check on monitor -- logs -- url filtering, nanime.live is blocked

HSutanto_0-1714366962003.png


Please your help

 

Thank you

1 accepted solution

Accepted Solutions

L2 Linker

Hello Friend!

 

URL filtering works different when using HTTP or HTTPS, since some payload might be encrypted or not, on the following KB you can find the reasons behind each behavior: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HAL0

Mark this comment as solution if you think this information is useful for you

Senior Network Security Engineer
PCNSE | CCNP | JNCIP

View solution in original post

6 REPLIES 6

Cyber Elite
Cyber Elite

can you try running the developer tools > network in your browser, to see what is being let though?

(did you make sure your browser cache has been cleared)

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

L2 Linker

Hello Friend!

 

URL filtering works different when using HTTP or HTTPS, since some payload might be encrypted or not, on the following KB you can find the reasons behind each behavior: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HAL0

Mark this comment as solution if you think this information is useful for you

Senior Network Security Engineer
PCNSE | CCNP | JNCIP

yes, i have try running the developer tools

left (using http) and right using https

HSutanto_0-1714462325705.png

 

if you access that website and look at the certificate, it appears that the certificate is reflecting a different URL (laznasphr.kilatdigital.com), which could be why the connection is seemingly being allowed

 

In SSL connections, URL filtering uses the certificate SNI instead of the HTTP GET

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

I tried to access another website moenime.com, when I check the hostname certificate same as the URL, but still can be accessed.

please your advice.

HSutanto_0-1714636944702.png

 

what does your logging report? Are you hitting a different rule, is the website reported as a different URL/category?

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization
  • 1 accepted solution
  • 1687 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!