topic Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing? in Firewall and Security Management

Lots of sites being categorized as anonymizers inc. Spotify and Bing?

Jennifer_Wilson — Mon, 04 Mar 2024 13:12:52 GMT

We block anonymizers and can see that at least open.spotify.com, www.bing.com teams web etc are being blocked as they are tagged as anonymizers by URL categorization.
Had reports this has been happening since last Friday.

online Checkpoint URL checker shows the spotify one as what you would expect (entertainmnet etc.) and the IP's on it as uncategorized.

But the URL & App DB on my management server says it's up to date with a version of 141202403031347 created 03/03/2023 13:47 and won't update past that one.

Anyone else seeing similar issues?

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

the_rock — Mon, 04 Mar 2024 13:40:30 GMT

Have not noticed it in my lab, shows up fine. When in doubt, I always check below, its correct 100% of the time

Best,

Andy

https://url-classification.io/?utm_source=g&utm_medium=a&utm_campaign=g2&gad_source=1&gclid=CjwKCAiA_5WvBhBAEiwAZtCU72KxTO16W8p3nJl-WWSqZOyi8wZtYuqnLPjnDsYUgNItjZg6lACSQxoCem4QAvD_BwE

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

the_rock — Mon, 04 Mar 2024 13:48:44 GMT

This is the log I see when going to bing.com

Andy

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

Morten_O — Mon, 04 Mar 2024 13:54:48 GMT

Yes, I have heard this from multiple customers within the last week or so. Heard that they needed to whitelist Bing, Teams, Office, WebEX and more - all categorized as Anonymizers.

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

the_rock — Mon, 04 Mar 2024 13:55:32 GMT

What version? We have many customers on R81.20 and no one reported this.

Best,

Andy

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

Morten_O — Mon, 04 Mar 2024 13:57:33 GMT

I think the majority of those with the problem are running R81.10

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

the_rock — Mon, 04 Mar 2024 14:02:06 GMT

That could be why...I will try later in R81.10 lab as well.

Andy

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

Jennifer_Wilson — Mon, 04 Mar 2024 14:04:26 GMT

Thanks for the info Morten, yes we are on R81.10 as well.

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

Jennifer_Wilson — Mon, 04 Mar 2024 14:05:55 GMT

Don't suppose you have the full list?
It's hard to figure out from our logs (lots of IP's rather than app names and we don't do SSL Decryption (do HTTPS Categprization))

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

the_rock — Mon, 04 Mar 2024 14:09:55 GMT

Just tried, yes, seems like it is an issue in R81.10. Btw @Jennifer_Wilson , https categorization is NOT replacement for ssl inspection, but regardless of the fact you dont have inspection turned on, even if you did, you would most likely have the same problem.

I would consider upgrading to R81.20, if you can.

Best,

Andy

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

Jennifer_Wilson — Mon, 04 Mar 2024 14:13:56 GMT

Don't suppose you know if that would work if we upgraded just the management server? (leaving the gateways on R81.10)

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

the_rock — Mon, 04 Mar 2024 14:15:31 GMT

I do know...it would NOT work, Im 100% positive. You need to upgrade the gateways, because upgrading the mgmt server only would not do much to change this behavior.

Best,

Andy

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

Morten_O — Mon, 04 Mar 2024 14:20:32 GMT

I don't think there is a full list - I just heard that lenovo.com is now also an Anonymizer....

Best solution would be to open an Service Request. Not everyone can just upgrade to R81.20 overnight

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

the_rock — Mon, 04 Mar 2024 14:21:53 GMT

I agree 100%, best to oppen TAC case and see what they come back with.

Andy

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

Jennifer_Wilson — Mon, 04 Mar 2024 14:38:50 GMT

cheers, thanks for the confirmation it would not work.

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

the_rock — Mon, 04 Mar 2024 14:40:52 GMT

No worries.

Andy

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

Morten_O — Mon, 04 Mar 2024 15:06:56 GMT

Is this test a new installation of R81.10 or an old one? Which Jumbo? I know it's much to ask, but does it help to clear the URLF-cache (sk64280)?

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

the_rock — Mon, 04 Mar 2024 15:07:53 GMT

All good mate, questions are FREE ; - ). Its not new install, had it for some time.

Btw, tried that first actually and its latest jumbo.

Best,

Andy

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

Jennifer_Wilson — Mon, 04 Mar 2024 16:12:25 GMT

Just need to add that we've discovered that (AV sig/Defender etc.) updates to microsoft windows PCs are also being blocked because of this (ie Windows Updates, Windows 11 Updates) etc.

Re: Lots of sites being categorized as anonymizers inc. Spotify and Bing?

the_rock — Tue, 05 Mar 2024 00:44:41 GMT

I hate to say this, but in your case, without even having inspection enabled, it would be totally pointless to add anything as bypass rules in the inspection policy, as that would only take effect if the feature is turned on.

Best,

Andy