Traffic hits policy with URL Category even though the traffic is not for that URL

[jwill2]

We have several policies that permit traffic to 80/443 with no specific destination address, but with a URL category set for a specific URL.  For example, we have a post-rule for VPN users to access our internal Splunk server via the URL.

The issue I'm seeing is that I am trying to connect to another device using https://ipaddress and the traffic is hitting our Splunk URL rule.

This is not the only URL Category rule we have.  I've also seen traffic hit a pre-rule we have using a URL Category.

Has anyone experienced this?  Is there a good solution?

[reaper]

are the log entires you are seeing actual proper traffic (ssl/web-browsing,.. app-id, normal session end etc) or are these incomplete app-id sessions?

these types of rules need to accept all web traffic in order for the firewall to be able to determine the url category (seen in the SNI of http GET typically) which means that at least 4 to 5 packets need to flow through that rule before it is able to determine if it should keep this session (category match) or release this session (no category match, security rule lookup for better match)

what happens if this is a 'rogue' session that is either broken (e.g. server stops responding) or 'abnormal' (url category not found before session already ended by server/client, early RST,.....) that the session dies before it can match a different more accurate rule so the log entry is written with the last rule that session hit before ending

rules with only URL category have a high catch rate for bad or broken sessions so there will be lots of logs that mysteriously seem to hit this rule

[jwill2]

Looking at the traffic log, the traffic is showing as incomplete and aged out.  I will have to try to replicate it and pull a packet capture to get more information

[reaper]

sounds like what i described, and expected behavior