topic Re: Granular Control of Navigation in Firewall and Security Management

Granular Control of Navigation

Joseflorez — Fri, 19 Mar 2021 13:53:50 GMT

I to try to create a policy that allow the navegation to URL of YouTube in specific, not to the application in general. I use URL Filtering and HTTP Inspection but it nots work. will this configuration be possible?

Re: Granular Control of Navigation

PhoneBoy — Fri, 19 Mar 2021 15:50:35 GMT

If you're trying to allow access to specific videos only...it's complicated due to the complexity of the YouTube site.
You create a custom application/site with the following (this is regex):

googlevideo.com (^|.*\.)youtube\.com/watch\?v=##VID##' (^|.*\.)youtu\.be/.*##VID##.* (^|.*\.)ytimg\.com/.*/##VID##/ (^|.*\.)youtube.com/embed/##VID##

Yes, each video requires four separate URLs.
Videos are streamed from *.googlevideo.com.

Note above is per: https://community.checkpoint.com/t5/SMB-Gateways-Spark/Allowing-or-blocking-specific-youtube-videos/m-p/109857

Re: Granular Control of Navigation

Joseflorez — Fri, 19 Mar 2021 19:45:42 GMT

Hi Phone Boy

I try to do the configuration of policy as you suggested but is not works, Appear a notification where there is characters that may affect performance. Even so I install policies but it doesn't work.

This is configuration

Rules

Rule HTTP Inspection

I try with the action in Bypass but get the same result. According to the configuration that I made, do I have something wrong?

Re: Granular Control of Navigation

Joseflorez — Fri, 19 Mar 2021 19:48:08 GMT

Thi is the custom application/site

Re: Granular Control of Navigation

PhoneBoy — Sat, 20 Mar 2021 06:36:37 GMT

You can't use the Custom Application Site with the HTTPS Inspection rule.
Use the service of HTTPS there.

Re: Granular Control of Navigation

Joseflorez — Sat, 20 Mar 2021 11:37:21 GMT

The custom application site with the HTTPS inspection rule I put it there as a test, if I remove it it does not work for me

Re: Granular Control of Navigation

PhoneBoy — Sat, 20 Mar 2021 17:13:27 GMT

The category for the HTTPS rule should be “any.”
I also don’t see googlevideo.com in the list.

Also the above assumes you’re on R80.40+ or R80.30 with a recent JHF.

Re: Granular Control of Navigation

Joseflorez — Wed, 24 Mar 2021 15:37:50 GMT

Hi PhoneBoy

The category for the HTTPS rule is ANY,

googlevideo.com is in the list just at the top, but it does not work.

The SMS version is HOTFIX_R80_40_JUMBO_HF_MAIN Take: 91

The GW version is HOTFIX_R80_30_JUMBO_HF_MAIN Take: 228

Re: Granular Control of Navigation

PhoneBoy — Wed, 24 Mar 2021 17:17:11 GMT

By "not work" what does that mean precisely?
What is the exact behavior?
Any (redacted) logs you can share?
Note the URLs in question were provided by a CheckMates member and we may be missing something.

Re: Granular Control of Navigation

Joseflorez — Fri, 26 Mar 2021 15:28:58 GMT

"Not work" mean that when i to try load the specific URL configure in the rule does not load, The log appear the traffic Inspected to youtube without anomalies.

I will try to change the syntax of the lines placed in the Custom Application Site. But from the fabricant's point of view this is possible? I had understood that HTTP Inspection takes the certificate of a URL to perform some action but not the content of the specific URL. For that reason I have the doubt if it is possible

Re: Granular Control of Navigation

PhoneBoy — Fri, 26 Mar 2021 16:58:15 GMT

Full HTTPS Inspection (not just HTTPS Categorization) is required to make this work.
That is the only way you can actually see the URL.
The Category/Custom Application Site in your HTTPS Inspection rule should not contain the Custom Application/Site you created for this purpose.
It needs to be "Any" or at the very least "Media Streams" to see everything YouTube-related.

If the above does not help, please provide screenshots of the exact behavior and logs seen and/or engage with the TAC.