topic Re: Url categorization issue specific sites in Firewall and Security Management

Url categorization issue specific sites

D_W — Mon, 10 Feb 2020 15:25:46 GMT

Hi,

quick question about Application and URLFiltering without HTTPS Inspection on R80.10.

We block category "web-advertisement" and at the moment when someone tries to access https://fontawesome.com it get's blocked and we only see that "ad-balancer.at" in the SmartLog is getting blocked in that session.

Anyone with the same behaviour?

KR
David

Re: Url categorization issue specific sites

Daniel_Taney — Mon, 10 Feb 2020 15:51:42 GMT

It looks like Check Point's only categorization for this site is "Computers / Internet". Are users attempting to access it by directly entering in that URL? Or are they searching for it and clicking on a search result?

One side effect I've seen from blocking the "Web-Advertisement" category is that many of the "top" links on Google (which are actually Ad hits) will not work.

If they are going directly to the URL, it could be that some portion of the site is redirecting to some ad or click-tracker before going to the actual webpage. If that is happening, there may not be much you can do besides white-listing "ad-balancer.at". Which I'm sure you don't want to do, but a poorly engineered website may not leave you a choice.

Re: Url categorization issue specific sites

D_W — Fri, 14 Feb 2020 19:04:43 GMT

Thanks for your reply. Yes only solution for now was to allow ad-banners.at.
I couldn't find the redirect to ad-banner.at or similiar sites on this website "fontawesome.com". Other websites are affected too. So i think there is another issue.

Also what's the best practice then to filter out web-ads?

Re: Url categorization issue specific sites

Daniel_Taney — Fri, 14 Feb 2020 21:09:57 GMT

I haven't found a better way to get around this besides accepting the reality that blocking this category will break a few websites and some exceptions may have to be put in. The way I see it, there is so much ad traffic on the Internet that, even with a few exceptions, you are probably still blocking more than you'll end up allowing by not filtering the category entirely.

Re: Url categorization issue specific sites

PhoneBoy — Fri, 14 Feb 2020 21:21:10 GMT

There are many browser plugins that do this quite effectively.
Obviously that doesn't scale to the network very well. 😛

Re: Url categorization issue specific sites

Daniel_Taney — Fri, 14 Feb 2020 21:28:55 GMT

If you have Identity Awareness configured, you could also write an Identity rule to allow those ad-sites for the users that need the website to work.