Translate Pop-up Feature Block

[E.Delil417682]

We recently started experiencing an issue with the google translate pop-up feature in browsers. When users try to use the google translate pop-up feature on any webpage the request is being denied by the firewall however accessing the google translate website directly works without any issue. On a sidenote we're currently using SSL decryption on our firewall. When checking the URL filtering logs we see that the same session is categorized under two different categories which are translate and private-ip addresses and the domain shown in the logs is translate.googleapis.com. Since the private-ip addresses category is configured as block in our URL filtering profile the request gets blocked even though it is related to google translate. What is confusing is that when we check the domain categorization globally we only see the translate category and not private-ip addresses. Any tips on how we can solve this problem? This issue didn't occur previously and it started recently.

[JayGolf · Accepted solution]

Hi @E.Delil417682 ,

I’d try testing an SSL Decryption Exclusion for translate.googleapis.com to see whether the browser pop-up translation starts working once that traffic is no longer decrypted. If it does, that would point to decryption as the cause.

If the issue still occurs after that, the next step would be to test this in Google Chrome with Developer Tools open before loading the page. From there, load a page and trigger the translate pop-up.

Try filtering on terms like translate or googleapis, though you may need to scroll through the entries as well. That should help confirm the exact calls being made by the pop-up feature so you can correlate them against the URL filtering and decryption logs on the firewall. If you’re able to identify the exact call being categorized as private-ip addresses, you could then test adding that to a custom URL category that is allowed.

[E.Delil417682]

Thank you for your suggestion. The issue is caused by decryption. I created a custom URL category for Google APIs URLs and added a no-decrypt rule above the decryption rule. After that, no private-ip-addresses category logs were generated. Therefore, the traffic is not being blocked.