topic Re: Unable to allow a URL via WIFI but works from Ethernet in Firewall and Security Management

Unable to allow a URL via WIFI but works from Ethernet

ledesgagnes — Wed, 11 Sep 2019 14:33:00 GMT

Hi,

To put in place a context, I am replacing a previous IT manager who left the enterprise several months ago.

I had a request put in place to allow certain URL which are in the Alcohol & Tobacco. So I went in Blade, under application and URL filtering and added a rule to allow this category.

I went with a source of: Any

Destination: Internet

Application: Category Alcohol & Tobacco

Action: Allow

When I am on the network, the rule work without any issue. Once I disconnect the cable and get on the wifi and hit the same URL, I am sent to a Check Point Application Control Page, where it says that Access is blocked according to the organization security policy. It also provide a Reference: 0B34CDBD.

I did research on the web and I've looked around in Blade but didn't find anything that differentiate Ethernate from WIFI.

Thanks

Re: Unable to allow a URL via WIFI but works from Ethernet

Maarten_Sjouw — Wed, 11 Sep 2019 16:55:29 GMT

What version are you running? When R80+ is the application/URL policy an inline layer? If so is there a different rule with inline layer for WiFi and LAN?

Re: Unable to allow a URL via WIFI but works from Ethernet

ledesgagnes — Wed, 11 Sep 2019 17:08:44 GMT

Hi Maarten

R77.30, so it would be something else...

Thanks

Louis

Re: Unable to allow a URL via WIFI but works from Ethernet

PhoneBoy — Wed, 11 Sep 2019 20:39:58 GMT

When it works, what rule is matched?
When it doesn't work, what rule is matched?
I suspect the block rule is happening before your allow rule.

Re: Unable to allow a URL via WIFI but works from Ethernet

ledesgagnes — Thu, 12 Sep 2019 18:10:05 GMT

I was suspecting that as well so I have removed the block rule (there was only one for that category)...but for a reason I don't understand it still applies it when I am on the WIFI. I did a lookup to see if there was any other rule which was using that Category but there wasn't.

If feels like there's a section for Ethernet which I see by default and another one for WIFI that's hidden by default and that I can't find.

Re: Unable to allow a URL via WIFI but works from Ethernet

Maarten_Sjouw — Thu, 12 Sep 2019 20:44:13 GMT

Be aware that in the Application rules your only reference is the name column. The name is all you will see in the logging, so that is the only way to identify which rule it matches on.

Re: Unable to allow a URL via WIFI but works from Ethernet

PhoneBoy — Fri, 13 Sep 2019 20:05:02 GMT

It may be getting blocked by an entirely different rule under a completely different category.
Make sure logging is enabled for every App Control rule.