Firewall is allowing certain packets through different policy in URL based traffic blocking scenario

[tamilvanan]

Hi Team,

We had configured an EDL today with URL list and created an security policy and applied it for an specific source IP address.

We had tried to access an URL in the EDL list and the website is not loading on the PC.

When checking the Traffic logs with source and destination IP some traffic is being blocked through desired policy. But some traffic is being allowed.

Is this an expected behaviour when comes to URL based blocking as the firewall will allow TCP handshake and the initial SSL/TLS handshake

[PavelK]

Thank you for posting question @tamilvanan

Since your EDL type is URL, I would recommend to check URL logs instead of Traffic logs.

Coming back to your question, could you please elaborate how you applied EDL? Did you add the block URL EDL directly under: Security Policy Rule > Service/URL Category or did you add under: Security Policy Rule > Profile Setting > URL Filtering / Group Profile?

If you applied it directly under Service/URL Category, then match against URL, will be blocked directly under security policy and you should see it in the Traffic log as being blocked. If you see this as allowed in the log, could you check more details under: Detailed Log View?

If you have applied it under: URL Filtering / Group Profile, then in Traffic log, you should see the result of policy being evaluated against 6 tuple. If the result is allow, then you will see this traffic being allowed in Traffic log, but as a subject of L7 processing under URL filtering in URL Filtering / Group Profile, the result in URL log will be block-url if there is a match.

Kind Regards

Pavel

[tamilvanan]

Hi @PavelK .

Thanks for your inputs.

I am going through the documentations and my understanding from those documentations is that the firewall handles HTTP and HTTPS traffic differently.

For HTTP traffic the firewall allow till the GET packet to identify the HTTP website the user is trying to access and blocks the HTTP site. So the initial packets will be allowed.

Same for HTTPS site the firewall will allow the traffic of TCP handshake , SSL/TLS handshake and then once the firewall get the Certificate it will look into the CN name of the certificate and will block that session. So we will see few packets going out to the websites when we filter on traffic log using the website IP address.

This is my understanding