topic Re: AppControl/URLF - Rules and classification in Firewall and Security Management

AppControl/URLF - Rules and classification

wanartisan — Sun, 20 Jul 2025 13:11:41 GMT

Hi all,

Scenario:

Smart-1 Cloud (R82)
Cloudguard Network Security (R81.20) HA (Azure)
Perimeter fw in Hub VNET.
URLF and AppControl blades enabled
And enabled in the policy
Inline layers configured for web browsing (any traffic; common web ports)
I have enabled categorise HTTPS traffic by SNI

I have been turning on URLF and AppControl and doing some testing on it. I created a very simple policy using inline layers

sub-layer 1: Allow categories Very Low Risk, Low Risk, Medium Risk
sub-layer 2: Block categories High Risk, Critical Risk, Unknown Risk
sub-layer 3: Clean-up.

We found a High Risk (4) application in the logs but it is being allowed by the sub-layer 1 despite being a High Risk application.

The application definition says you need to apply HTTPS Inspection but the it is being properly categorised without HTTPS Inspection being applied yet is being caught by sub-layer 1.

Is this expected behaviour? Any other thoughts on how to resolve this?

I want to keep HTTPS Inspection to a minimum.

Re: AppControl/URLF - Rules and classification

Chris_Atkinson — Sun, 20 Jul 2025 14:09:50 GMT

Categorisation set for background or hold?

Are you able to share the example application?

R81.20 Jumbo T65 or higher?

Is QUIC traffic blocked in the environment?

Re: AppControl/URLF - Rules and classification

the_rock — Sun, 20 Jul 2025 18:02:54 GMT

All excellent questions by Chris. Apart from that, can you send the relevant log? Please blur out any sensitive data. I can tell you from my experience, below is what I found works best.

Andy

https://community.checkpoint.com/t5/General-Topics/https-inspection-tip-feedback-suggestion/m-p/253038#M42425

Re: AppControl/URLF - Rules and classification

wanartisan — Mon, 21 Jul 2025 07:42:48 GMT

Hi Chris,

We're on Take 98 and QUIC is blocked.

I think I have found the reason for the Allow in the Matched Rules part of the log - it is classed as Medium risk. So why is a High risk app matching as Medium?

I can attached the sub-layers and log output.

Re: AppControl/URLF - Rules and classification

Chris_Atkinson — Mon, 21 Jul 2025 13:18:18 GMT

If the issue is reproducible I would suggest reviewing further with TAC.

Note for awareness Take 99 lists the following:

PRJ-56812 - Application Control - An application may not be matched to an Application Control rule.

Re: AppControl/URLF - Rules and classification

wanartisan — Mon, 21 Jul 2025 17:01:59 GMT

Thanks Chris,

Could be that, I guess. I've scheduled and update to T05. Will report back.