topic Re: URL Filtering Pornography Category not Working - Custom Application Works in Firewall and Security Management

URL Filtering Pornography Category not Working - Custom Application Works

SecurityNed — Wed, 28 Aug 2024 07:31:05 GMT

Hello Checkmates!

I'm in this unusual dilemma right after migrating to a 2-tier firewall setup. Before when everything is on separate HA instances, everything is working as intended (This was all working from when I started the setup from R80.10 up until R80.40 before we did the activity). Now that everything is running on R81.10, for some reason, categories are not working. Thinking that it might be due to the fact that we have an external firewall that only handles DMZ traffic, I confirmed it by creating a custom application and creating a policy for it. The custom application works for Microsoft Edge, and Mozilla Firefox, but not on Chrome.

Now if everything is working as it should be, it would be blocked by policy 44.2, instead on 44.3 but that's not the case. When I tried to use the HTTPS inspection, user experience is really bad that it would take around a minute or so to just open google.com, and even then, porn sites aren't blocked at all by category. (Policies are currently disabled after testing)

Now I would like your input if the behavior is due to the firewall design being 2-tier? If so do I still need to configure blocking policies on the external NGFW pair? I really remember before on the R80 days that its as easy as clicking 1 2 3, but right now for some reason its not working as it should be.

I'll attach configuration screenshots that might help.

Thanks for the help!

Re: URL Filtering Pornography Category not Working - Custom Application Works

SecurityNed — Wed, 28 Aug 2024 07:27:35 GMT

For the reference of everyone, here's the log entries for the aforementioned working 44.3 policy:

Re: URL Filtering Pornography Category not Working - Custom Application Works

Lesley — Wed, 28 Aug 2024 07:46:12 GMT

If you are not using HTTPS inspection you should atleast do the light version of it.

Is this enabled? In Application & Url Filtering Settings under Url Filtering -> Categorize HTTPS websites.

Re: URL Filtering Pornography Category not Working - Custom Application Works

SecurityNed — Wed, 28 Aug 2024 07:49:12 GMT

Hello @Lesley ,

Yes, it is configured as you mentioned, but even then, the behavior's the same. I can block YouTube as per corporate policy, but not porn sites.

Re: URL Filtering Pornography Category not Working - Custom Application Works

Lesley — Wed, 28 Aug 2024 07:55:00 GMT

So to make summary,

websites get's blocked in all browsers but not in Chrome? Is it only this website that does not get blocked in Chrome or also others?

What version and jumbo take?

Re: URL Filtering Pornography Category not Working - Custom Application Works

SecurityNed — Wed, 28 Aug 2024 08:15:31 GMT

Its somewhat a hit or miss on the browsers, but to summarize:

I can't block pornography via category
I can block specific pornographic URLs via custom application/site
I confirmed that Application blocking works as we blocked Youtube as an application
I can confirm that I can reliably block pornographic websites through my custom application/site on Mozilla Firefox, but not on Google Chrome and Microsoft Edge

The target that we want to achieve is to successfully block categories via the blade, and not rely on custom applications/sites.

The internal Firewall is running on: R81.10 take 335

Please see the cpinfo -y all result

Re: URL Filtering Pornography Category not Working - Custom Application Works

Lesley — Wed, 28 Aug 2024 08:25:17 GMT

Looks like you have a clean R81.10 without any Jumbo take on it.

Would recommend to upgrade the Jumbo asap:

https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/R81.10/Introduction.htm

Could you run Chrome without HTTP2? -> https://my.f5.com/manage/s/article/K000092500

Let me know results. If positive upgrade to take 158 if not pick GA take 156.

Re: URL Filtering Pornography Category not Working - Custom Application Works

Alex- — Wed, 28 Aug 2024 08:26:54 GMT

You might be running into sk182318.

You don't have any hotfixes installed and the solution for this behaviour on Chrome/edge is located in Take 150.

Re: URL Filtering Pornography Category not Working - Custom Application Works

SecurityNed — Wed, 28 Aug 2024 08:27:49 GMT

Hello Lesley,

This is noted, I'll update you once the JHF is installed.

For the chrome to run without HTTP2, I need to read it first.

Re: URL Filtering Pornography Category not Working - Custom Application Works

SecurityNed — Wed, 28 Aug 2024 08:45:19 GMT

Hello @Alex- ,

I'm currently downloading JHF T-156 manually, as I just realized that my internal firewall doesn't have internet access.

I'll upload it and wait for the maintenance window to push the JHF installation.

Re: URL Filtering Pornography Category not Working - Custom Application Works

emmap — Wed, 28 Aug 2024 08:53:42 GMT

Your firewall must have internet access for URL Filtering to work reliably, as URLs seen are checked in real time via the resource advisor to match against categories.

Re: URL Filtering Pornography Category not Working - Custom Application Works

SecurityNed — Wed, 28 Aug 2024 08:57:12 GMT

But how was it that application control works as intended? I can reliably block Youtube and Dropbox. Either way I'll try to resolve the internet connectivity issue for this, as the behavior is unusual as well. LAN users, which runs on the same IP segment as my internal firewall, has internet connection, but not my firewall.

Re: URL Filtering Pornography Category not Working - Custom Application Works

emmap — Wed, 28 Aug 2024 09:06:38 GMT

Application Control works off the database that the gateway has downloaded. It presumably has one from before the re-architecture that's still working ok, but it is likely not getting updates.

Re: URL Filtering Pornography Category not Working - Custom Application Works

SecurityNed — Wed, 28 Aug 2024 09:10:01 GMT

I just confirmed that my blade is updating as intended:

Re: URL Filtering Pornography Category not Working - Custom Application Works

emmap — Wed, 28 Aug 2024 09:33:58 GMT

Those updates are the management server only, the gateways fetch their own updates. If they are struggling they should throw an error that you can see in the Gateways and Servers view, per gateway.

Re: URL Filtering Pornography Category not Working - Custom Application Works

SecurityNed — Wed, 28 Aug 2024 09:42:44 GMT

It is confirmed that the gateway attempt failed:

I know this is not related to the main thread, but I want to ask as I'm troubleshooting the connectivity issue for my internal firewall. I'm currently pinging via clish, and while doing fw ctl zdebug + drop on my external firewall, I can't see anything.

When checking the logs through SmartConsole, I see them as allowed but through the implied rule.

I just want to know, I have the hunch that this is the cause, and would want to know if there's a way to make it not go through the rule so that a firewall rule will accommodate the traffic?

Re: URL Filtering Pornography Category not Working - Custom Application Works

Chris_Atkinson — Wed, 28 Aug 2024 10:43:16 GMT

Do you see UDP/443 or Quic traffic in your logs?

Re: URL Filtering Pornography Category not Working - Custom Application Works

SecurityNed — Wed, 28 Aug 2024 10:53:19 GMT

Hello @Chris_Atkinson ,

Yes there are quic traffic present in the logs and its being blocked by a policy.

Re: URL Filtering Pornography Category not Working - Custom Application Works

emmap — Thu, 29 Aug 2024 05:00:39 GMT

Whether it's an implied rule or an explicit rule, the traffic is being accepted through the policy. If you're not seeing anything in the zdebug + drop then it's not being dropped - go simpler, can you see it in a tcpdump on the external gateway? On both the internal side and the external side of it? Is the external gateway hideNATing the connections?

Re: URL Filtering Pornography Category not Working - Custom Application Works

Chris_Atkinson — Thu, 29 Aug 2024 05:23:27 GMT

This thread provides the missing detail.

Internal Firewall Has No Internet Connection, But ... - Check Point CheckMates