topic Re: Traffic dropped only in clean-up rule?? in General Topics

Traffic dropped only in clean-up rule??

RemoteUser — Wed, 28 May 2025 16:41:45 GMT

Hi Guys.
I’m running tests on URL Filtering with a Check Point cluster running R81.20 with Jumbo Hotfix Take 99.
HTTPS Inspection is not enabled.

There is a rule inside an inline layer that blocks traffic categorized as Sex/pornography

behavior:

When the cleanup rule of the inline layer is set to Drop, the site is blocked correctly
When the cleanup is set to Accept, the site loads successfully
The site in question is correctly categorized as Sex/pornography
QUIC traffic is blocked via a separate rule

Why is this site being blocked only when the inline layer's cleanup rule is set to Drop, even though it doesn’t match the rule above that should block it based on its category?
Thanks a lot

Re: Traffic dropped only in clean-up rule??

PhoneBoy — Wed, 28 May 2025 17:31:24 GMT

Does it happen with all pornography sites or just specific ones?
And if I understand you correctly, you ARE seeing the correct category when it’s dropped by the Cleanup rule, correct?

You might want to use fw up_execute on the gateway to see what rule(s) the traffic might be potentially matching.

Re: Traffic dropped only in clean-up rule??

RemoteUser — Wed, 28 May 2025 18:48:11 GMT

Hi @PhoneBoy
Some websites are correctly categorized under the "Sex" and "Pornography" categories.

The inline layer is configured as follows:

RULE 1
- Source: WK-LAB
- Destination: Internet
- Services: HTTPS and HTTP
- Action: Inline Layer (this is the parent rule)
Inside the inline layer:
- RULE 1.1
  - Source: WK-LAB
  - Destination: Internet
  - Services: Sex, Porn
  - Action: Drop
- RULE 1.2
  - Source: WK-LAB
  - Destination: Internet
  - Services: Any
  - Action: Accept

Now, a few websites are correctly classified under the "Sex" and "Pornography" categories, so I would expect them to be blocked by Rule 1.1 and indeed, the SmartConsole logs show that these connections are being dropped by Rule 1.1.

However, the websites are still accessible in the browser, despite being dropped in the logs.

If I change the cleanup rule (Rule 1.2) from Accept to Drop, then the sites are no longer accessible which is expected behavior.

But when Rule 1.2 is set to Accept, the websites remain accessible, even though they are logged as being dropped by Rule 1.1.
This behavior is confusing and I cannot explain why it's happening.

Re: Traffic dropped only in clean-up rule??

Lesley — Wed, 28 May 2025 18:50:56 GMT

Check the following in SmartConsole -> Manage & Settings -> Blades -> Application control & URL filtering

- first check if categorize is enabled

- second check if website categorization mode is hold or background

Double check if this bug is relevant for you:

PRJ-57181,

PRHF-36126

URL Filtering

URL Filtering may not classify a site in a specific rare scenario when the Security Gateway is configured as a proxy.

I think this site is not in gateway cache. GW is going to cloud and in the mean time the site is allowed. Does this makes sense?

Re: Traffic dropped only in clean-up rule??

RemoteUser — Wed, 28 May 2025 19:03:08 GMT

Hey Buddy,
the gw does not use a proxy to go out on internet, i have a simple nat rule that says from the wk to go out on the internet natt it with the gw...
categorize is enabled
website categorization mode is hold

Re: Traffic dropped only in clean-up rule??

the_rock — Wed, 28 May 2025 19:09:31 GMT

Ola bro,

That sounds like normal behavior. Technically, for example, what I do in my lab is this.

net layer, allow access from windows 11 machine behind cluster

urlf layer, block access to desired categories, then any any allow at the bottom

Traffic has to be ALLOWED on all the layers, thats the key.

Andy

Re: Traffic dropped only in clean-up rule??

the_rock — Wed, 28 May 2025 19:13:13 GMT

Let me clarify that...traffic has to be allowed on all the ORDERED layers.

Re: Traffic dropped only in clean-up rule??

PhoneBoy — Wed, 28 May 2025 19:53:48 GMT

In modern versions of web browsers, QUIC (UDP 443) is preferred, not HTTP/HTTPS (TCP 80/443).
We do not support filtering of QUIC traffic until R82, and I believe this also requires HTTPS Inspection,
In all other cases, QUIC should be explicitly dropped in your policy or you can expect to see results like this.
If QUIC traffic fails, browsers will fall back to using HTTPS.
Your top-level rule doesn't mention QUIC at all, which means the traffic is being allowed by another rule.

Re: Traffic dropped only in clean-up rule??

RemoteUser — Wed, 28 May 2025 19:59:33 GMT

Yes, this is clear to me.

But beware that I made explicit a drop rule to the QUIC protocol, above the inline layer.

And not inside the inline layer.

Re: Traffic dropped only in clean-up rule??

Lesley — Wed, 28 May 2025 20:14:34 GMT

Try background and give it couple more tests

Re: Traffic dropped only in clean-up rule??

PhoneBoy — Wed, 28 May 2025 20:34:35 GMT

I can only work off the information given, which didn't mention QUIC at all. 🙂

On your inline rules, change the logging to Extended.
This should show ALL the URLs accessed, some of which might be allowed.

If you can send me some working and non-working examples in PM, I can have a look.
However, I suspect a TAC case is probably where this is heading.

Re: Traffic dropped only in clean-up rule??

the_rock — Wed, 28 May 2025 22:49:30 GMT

Part of this could be ssl indpection being off, though for this issue, it just wont present block page.

Re: Traffic dropped only in clean-up rule??

Chris_Atkinson — Wed, 28 May 2025 23:26:34 GMT

What TLS version do you observe for communication with this this site, is it using encrypted SNI?

Re: Traffic dropped only in clean-up rule??

RemoteUser — Thu, 29 May 2025 06:33:32 GMT

I treid in R82 environment, and ti's works.
there only one site that it's accessbile on chrome but not in edge...

Re: Traffic dropped only in clean-up rule??

RemoteUser — Thu, 29 May 2025 07:08:20 GMT

Traffic inspection over QUIC or HTTP/3 is supported as of R82.

This future will also be implemented in R81.20??? I think that is precisely why it was not going

Re: Traffic dropped only in clean-up rule??

RemoteUser — Thu, 29 May 2025 09:08:33 GMT

TLS version1.2 i see

Re: Traffic dropped only in clean-up rule??

the_rock — Thu, 29 May 2025 12:05:12 GMT

Hey bro,

I will test this in the lab Sunday.

Andy

Re: Traffic dropped only in clean-up rule??

Chris_Atkinson — Thu, 29 May 2025 12:08:49 GMT

Don't believe it is currently planned.

To clarify R82 is working for you with or without HTTPS inspection?

Re: Traffic dropped only in clean-up rule??

RemoteUser — Thu, 29 May 2025 13:04:15 GMT

Yes, some sites are blocked on the R82, but not on the R81.20.

Re: Traffic dropped only in clean-up rule??

RemoteUser — Thu, 29 May 2025 13:06:30 GMT

Hey brother,
Yes, keep me posted, i tried the behavior in R81.20 and R82, the url filtering work better in R82 there is no doubt