topic Re: Url filtering detects in Firewall and Security Management

Url filtering detects

Ihenock1011 — Mon, 15 Jan 2024 13:57:20 GMT

Hi All,

I have an R81.10 security gateway in VSX mode, and URL/Application filtering is enabled. The URL is explicitly allowed in the app/URL filtering rule base. However, the URL filtering indicates the detection of one of the URLs and reports an untrusted certificate, even though it is a valid certificate. This issue is blocking users from accessing the site. What should I check in order to resolve this?

Thanks,

Re: Url filtering detects

the_rock — Mon, 15 Jan 2024 14:02:36 GMT

Hey @Ihenock1011 ,

Are you able to send a screenshot? I have real good https inspection lab going in R81.20, so can also do a quick test if needed. Please blur out any sensitive info mate.

Best,

Andy

Re: Url filtering detects

Ihenock1011 — Tue, 16 Jan 2024 06:13:57 GMT

@the_rock

sure, Attached is the screenshot for the specific log.

Re: Url filtering detects

emmap — Tue, 16 Jan 2024 07:45:22 GMT

Is it a public website? Is it a valid certificate publically or for your domain?

Re: Url filtering detects

Ihenock1011 — Tue, 16 Jan 2024 09:02:05 GMT

@emmap Yes, its SWIFT's cloud service.

https://tracker.browse.swiftnet.sipn.swift.com

Re: Url filtering detects

emmap — Tue, 16 Jan 2024 09:34:58 GMT

When I load that link I get an invalid CA error in Chrome, and viewing the cert it doesn't look like it was issued by any publicly trusted CA. It looks like this is a valid determination by the gateway. To get around this you'll have to do an IP based bypass, which might be a challenge depending on where/how the service is hosted.

Re: Url filtering detects

the_rock — Tue, 16 Jan 2024 12:31:13 GMT

I know customer had an issue like this 2 years ago, I will check my notes later and see what was the solution.

Andy

Re: Url filtering detects

the_rock — Tue, 16 Jan 2024 12:32:47 GMT

I see what @emmap is saying, its definitely NOT issues by valid trusted CA authority.

Best,

Andy

Re: Url filtering detects

the_rock — Tue, 16 Jan 2024 12:45:44 GMT

This is what customer told me back in 2023 when they had this issue, but again, not sure if this might be the case with you...

Andy

***********

We found the problem. I’m not sure how this happened but looks like we were missing the SAN (Subject Alternative Name in the certificate).

******************