topic Re: Zoom and Custom Application/Site in Firewall and Security Management

Zoom and Custom Application/Site

JPR — Wed, 19 Feb 2025 10:18:25 GMT

I got two questions I hope some of you can help me with.

I have a rule in my rulebase that looks like this:

The content of the Custom Application Site is this:

I have a rule further down that blocks various categories. When I go to https://zoom.com it hits the rule above and I get to the site. When I go to https://zoom.us it doesn't hit the rule above, but continues and gets blocked by the rule that block various categories. Do any of you have any idea as to why that is?

Zoom.us gets blocked because it falls into the category of "Web Confenrencing":

The funny thing is, though, we don't block for that:

Do any of you have an idea to why it gets blocked anyway?

Thanks!

Re: Zoom and Custom Application/Site

Tal_Paz-Fridman — Wed, 19 Feb 2025 10:26:31 GMT

Have you tried using the predefined Zoom applications?

Re: Zoom and Custom Application/Site

JPR — Wed, 19 Feb 2025 11:13:08 GMT

Sorry, I can see I needed to add a bit more context.

The thing is, that it is an inline rule:

So we allow conncetions to zoom.com and zoom.us unless it is one of these URLS:

We don't allow people to join Zoom meetings from our internal environment, but they need to be able to schedule meetings and so on.

Re: Zoom and Custom Application/Site

AkosBakos — Wed, 19 Feb 2025 12:15:07 GMT

Hi @JPR

The HTTPs Inspection is enabled on the firewall?

https://support.checkpoint.com/results/sk/sk106623

Akos

Re: Zoom and Custom Application/Site

PhoneBoy — Wed, 19 Feb 2025 16:09:22 GMT

That’s weird because zoom.us shows up as Computers/Internet when I look it up:

Do the logs explicitly say this is the rule that is blocking the traffic?
And are you using HTTPS Inspection because you can’t block on a specific HTTPS URL without it.

Re: Zoom and Custom Application/Site

JPR — Thu, 20 Feb 2025 11:03:57 GMT

I've tried to modify my rule(s) the way Akos suggested and it worked yesterday, but this morning zoom.us was again being blocked:

HTTPS Inspection in enabled and it gets inspected, however, I no longer see any categorization in the actual log:

And I experience the same for cran.r-project.org that gets categorized as Computer/Internet (which we don't block), however, it hits our blocking of categories rule. And again there's no category in the log in SmarteConsole.

The above was a mistake. cran.r-project.org is categorized as Software Downloads and that we are blocking (r-project.org is categorized as Computers/Internet and works); my bad...

I still don't see any categories in the Smart Console logs. Is that an issue, though?

Any ideas? 😕

Re: Zoom and Custom Application/Site

PhoneBoy — Thu, 20 Feb 2025 13:19:52 GMT

I suggest involving TAC here.

Re: Zoom and Custom Application/Site

the_rock — Thu, 20 Feb 2025 17:55:06 GMT

What I always do in my lab is create custom category like you did, but simply add *zoom*, thats it.

Andy

Re: Zoom and Custom Application/Site

JPR — Fri, 21 Feb 2025 14:46:29 GMT

Thanks to all of you; always appreciate your input 🙂

I think I got it to work, however, I'm still a little worried/suspicious as to why it started working rather randomly especially access to zoom.us.

I tried with URLs as Regex as Akos suggested, but I've ended up just doing it non-regex and it seems to work after some trial and error with the URLs.

I'm considering involving TAC regarding the issue with categorization and missing categories in the log file, but I just want to be sure it's not just a simple mistake in my end.

Re: Zoom and Custom Application/Site

the_rock — Fri, 21 Feb 2025 14:49:57 GMT

I think thats a good idea, they can definitely confirm.

Andy