URL games allowed through while blocked

[THall1415]

HI Gang,

Fairly new palo user here 👋

I'm having a headache where I have configured URL filtering to block students from accessing games. I have decryption in place however they are freely accessing those games (the site is both categorized as low risk (alert) and games (block)). 

I've been reading forums and the block is supposed to take precedence, I have read I need decrypt which looks like that is the case, even more weird under Monitor | URL filtering the action is block-url, now I'm clearly missing something, can anyone suggest what that could be?

Rock on

(the query (url contains azgames.io), brings up that string under a google analytics URL, categorized as computer and internet) 

[mshekh]

Hi @THall1415 ,

You may try with capturing the traffic to understand what is passing through from firewall and also revisit to your polices and decryption as if decryption is working correctly and contents are matching with existing security policy also check if you do have other security policies on top to configured polices which are allowing the access.

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/monitoring/take-packet-captures

https://docs.paloaltonetworks.com/network-security/decryption/administration/decryption-overview

https://docs.paloaltonetworks.com/advanced-url-filtering/administration/configuring-url-filtering

[THall1415]

An FYI, I found that it was down to the Quic protocol.

Blocked that at firewall level, also (so it wouldn't try and timeout) changed our policies for chrome and edge to disable Quic.

disabled in both edge and chrome as well as at