topic Traffic to domain excepted is still blocked in General Topics

Traffic to domain excepted is still blocked

Pvalderrama — Thu, 01 Dec 2022 15:24:08 GMT

Hello friends,

Nice to greet you all.

I need your help. I have the following problem. I need to access the website "usage.projectcalico.org" I have enabled it by regex and by fqdn, and the log also shows the domain *r.cloudfront.net, which I have also enabled by wildcard regex "*r.cloudfront .net" .... but the lock remains. It can be seen in the "SNI" column that contains the domain that I want to enable. Also, I have enabled a bypass rule in SSL inspection, but the blocking persists. Has anyone else had this problem and know how to fix it? I attach the evidence image.

Re: Traffic to domain excepted is still blocked

the_rock — Fri, 02 Dec 2022 01:29:40 GMT

Can you try by allowing custom app site and try *projectcalico* and also bypass that in https inspection policy.

Re: Traffic to domain excepted is still blocked

PhoneBoy — Fri, 02 Dec 2022 23:40:11 GMT

What version/JHF level are you running?
We only use Verified SNI if you’re on R80.40 or above.
In R80.30 or R80.20, you need to be on a specific JHF level AND have HTTPS Inspection enabled.

Re: Traffic to domain excepted is still blocked

Blason_R — Sat, 03 Dec 2022 05:41:54 GMT

Did you try creating a domain object/FQDN Object? and keeping same dns on firewall which is kept at user level?

Re: Traffic to domain excepted is still blocked

Pvalderrama — Mon, 05 Dec 2022 14:33:16 GMT

Hi, friend. Thank you very much for the reply. I have version r81.10

Re: Traffic to domain excepted is still blocked

G_W_Albrecht — Mon, 05 Dec 2022 14:43:44 GMT

usage.projectcalico.org is not available in firefox also without CP GW:

Connection	keep-alive
Content-Length	23
Content-Type	application/json
Date	Mon, 05 Dec 2022 14:41:39 GMT
Via	1.1 42c9dddb4e518a9ed3248bf50565b120.cloudfront.net (CloudFront)
X-Amz-Cf-Id	zk4XqztmW584JeeKX51WBO5Umsg8Jmn1oJT4RPQUFHKWu8oY8CiG3w==
X-Amz-Cf-Pop	VIE50-C2
X-Cache	Error from cloudfront
x-amz-apigw-id	crVtpFdMNjMFoYg=
x-amzn-ErrorType	ForbiddenException
x-amzn-RequestId	7af7c8f5-4dde-40bd-b8e4-ad09ae2f7c11

Accept	text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8
Accept-Encoding	gzip, deflate, br
Accept-Language	de,en-US;q=0.7,en;q=0.3
Connection	keep-alive
DNT	1
Host	usage.projectcalico.org
Sec-Fetch-Dest	document
Sec-Fetch-Mode	navigate
Sec-Fetch-Site	none
Sec-Fetch-User	?1
Upgrade-Insecure-Requests	1
User-Agent	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:107.0) Gecko/20100101 Firefox/107.0