topic Re: Most URLs categorized as X-VPN this morning in General Topics

Most URLs categorized as X-VPN this morning

Marcel_Gramalla — Thu, 11 Apr 2024 06:15:36 GMT

Hi,

we encountered a big issue this morning as nearly all URLs were categorized as X-VPN application which is blocked in our rulebase because of the category (Anonymizer) and it's also set to critial risk.

Did you encounter the same and is there any official statement? It's obviously an issue with the database and the first time we see such an issue.

Re: Most URLs categorized as X-VPN this morning

Albin — Thu, 11 Apr 2024 06:34:11 GMT

Hi,

We have the same issue. We had this the other day and just now again on one site.

Re: Most URLs categorized as X-VPN this morning

Daniel_Hainich — Thu, 11 Apr 2024 06:41:31 GMT

hi,

we have the same issue since today.

Re: Most URLs categorized as X-VPN this morning

Sebastian — Thu, 11 Apr 2024 06:42:50 GMT

Hi all,

We have the exact same issue! Nothing is passing by as every web request is categorized as X-VPN and therefore blocked.

Re: Most URLs categorized as X-VPN this morning

Nenad_Odic — Thu, 11 Apr 2024 06:47:28 GMT

We have this from this morning,is there a reason why or we have to raise a TAC ticket?

Re: Most URLs categorized as X-VPN this morning

sascham — Thu, 11 Apr 2024 06:48:25 GMT

Hello,

same issue here. It started around 04:12 AM CEST.

Re: Most URLs categorized as X-VPN this morning

tomaszek — Thu, 11 Apr 2024 06:49:51 GMT

Yes, we have the same issue

Re: Most URLs categorized as X-VPN this morning

Stephan_Scholz — Thu, 11 Apr 2024 06:56:20 GMT

Same here. Any comments from Check Point?

Re: Most URLs categorized as X-VPN this morning

Nenad_Odic — Thu, 11 Apr 2024 06:59:43 GMT

Just raised

Case

6-0003912005

so we will see if they come up with an idea ,other that remove anonymizer category from rules.

Re: Most URLs categorized as X-VPN this morning

Josef_Maier — Thu, 11 Apr 2024 07:02:29 GMT

Hi,

we have the same problem. We registered an ticket bye Check Point Support. At the moment no reaction. On the status Checkpoint website https://status.checkpoint.com/ there are all services OK.

Re: Most URLs categorized as X-VPN this morning

_Val_ — Thu, 11 Apr 2024 08:12:42 GMT

Hi all,

We are aware of the miscategorization by Application Control / URL Filtering blade, where legitimate traffic is categorized as X-VPN and being dropped accordingly. Right now, a joint Task force that includes both R&D and TAC experts are working together to mitigate the issue.

We will keep you posted

Re: Most URLs categorized as X-VPN this morning

Nenad_Odic — Thu, 11 Apr 2024 07:25:17 GMT

thank you Val,

hope you will sort it out

Re: Most URLs categorized as X-VPN this morning

_Val_ — Thu, 11 Apr 2024 07:37:10 GMT

I will update this post once we have a definitive fix.

Re: Most URLs categorized as X-VPN this morning

796570686578 — Thu, 11 Apr 2024 07:38:29 GMT

Thank you for your quick response!

Is it possible that you provide a status update in this thread as soon as you get the news that the issue has been resolved? That would would be amazing.

Appreciate you and best regards

Re: Most URLs categorized as X-VPN this morning

FedericoB — Thu, 11 Apr 2024 08:09:28 GMT

I'm experiencing the same issue since this mornig.

Re: Most URLs categorized as X-VPN this morning

GeoMal86 — Thu, 11 Apr 2024 08:41:05 GMT

Same here... We have spent an hour thinking that our PCs were infected and trying to find what happened.

This seems to only be happening on Harmony Connect?

Update: nvm, it's happening on all gateways.

Re: Most URLs categorized as X-VPN this morning

Tom_Hinoue — Thu, 11 Apr 2024 08:49:50 GMT

It seems the issue is occurring for users that are using Full SSL Inspection.
We have a case open to TAC since yesterday but no updates yet.

I noticed X-VPN signature was updated on 8-Apr (Mon) in APPI package No. 070424_1.
If this is the case, then I hope a new package is released soon 🙂

Re: Most URLs categorized as X-VPN this morning

Vincent_Croes — Thu, 11 Apr 2024 08:54:18 GMT

This is not the case. We do not use full ssl inspect and are still impacted.

Question to Check Point, when can we expect an official statement?

Re: Most URLs categorized as X-VPN this morning

Tom_Hinoue — Thu, 11 Apr 2024 08:57:49 GMT

Thanks for sharing.
It's strange because we have many customers but don't experience this issue with only HTTPS categorization... Note we do have Anonymizers to be blocked in the policy.

Re: Most URLs categorized as X-VPN this morning

StefanSchmidt — Thu, 11 Apr 2024 09:11:37 GMT

Same problem here, seeing this since April 8 4pm CEST