topic Re: URL Filtering Doesn't work on HTTPS in General Topics

URL Filtering Doesn't work on HTTPS

Ryan_Ryan — Tue, 09 Oct 2018 23:15:56 GMT

Hi all,

We have R77.30 gateway, with HTTPS inspection enabled.

When a user visits a website that matches a blocked category (an obvious example - an adult website) if they go via HTTP, the page is blocked and user message is displayed. However if they go to the same site with https, the page loads fully.

In the logs, I can see HTTPS inspection has inspected the page, and also correctly categorized it (matching a category that should be blocked), however there are no logs in URL filtering. (There is a log in URL filtering when its correctly blocked over http)

I have tested with both "categorize HTTPS sites" enabled and disabled, same result, - I believe since we are doing full inspection it should be disabled.

Any ideas?

thanks

Re: URL Filtering Doesn't work on HTTPS

Ofir_Shikolski — Wed, 10 Oct 2018 05:38:44 GMT

How you configured the "Engine Settings"?hold mode?

Re: URL Filtering Doesn't work on HTTPS

Ryan_Ryan — Wed, 10 Oct 2018 06:05:23 GMT

It's set to background mode, but as its the same URL I am always testing to, and the fact categorization is correct in https inspection logs, I am expecting it to block?

Re: URL Filtering Doesn't work on HTTPS

Ofir_Shikolski — Wed, 10 Oct 2018 06:13:03 GMT

I think that with R80.10 and above there is also a different settings for HTTP .

in case you can see correct categorization with HTTPS, it should block it.

I'm using "hold" mode , but I"m using R80.20/R80.10

Did try to check this one ? How to clear URL Filtering kernel cache?

+ Access to HTTPS sites is intermittent - web site opens only after the user refreshes the page several times

Re: URL Filtering Doesn't work on HTTPS

Alex_Weldon — Wed, 10 Oct 2018 17:53:26 GMT

Are you serving up your UserCheck page using HTTPS? If not, you can switch this in cluster properties -> UserCheck -> UserCheck Web Portal. Edit the http and change it to https. We sometimes would not get the UserCheck message due to "mixed content" issues. This seems to have resolved it for us.

Re: URL Filtering Doesn't work on HTTPS

Ryan_Ryan — Wed, 10 Oct 2018 21:38:23 GMT

* How to clear URL Filtering kernel cache?
tried clearing the cache, but still the same result

* Access to HTTPS sites is intermittent - web site opens only after the user refreshes the page several times
Had a look but doesnt seem related to our issue

* Are you serving up your UserCheck page using HTTPS
Just tried changing it, still allows me to fully load well known XXX websites through HTTPS, switch to http and blocks me everytime

Just seems like the https inspection blade is not passing the traffic on to the app+URL blade

Re: URL Filtering Doesn't work on HTTPS

PhoneBoy — Fri, 12 Oct 2018 07:34:10 GMT

A few things to check:

Is Categorize HTTPS Sites on?

Is the traffic really HTTPS and not, say, QUIC or HTTP/2? We only categorize HTTP/HTTPS traffic, not QUIC or HTTP/2, which should be blocked in your App Control policies.

Re: URL Filtering Doesn't work on HTTPS

Ryan_Ryan — Sun, 14 Oct 2018 23:59:58 GMT

Hello,

Categorise HTTPS is currently off (we are doing full https inspection) however have tried it on aswell with the same result.

Yes I am testing across a broad range of generic websites (adult, illegal, cloud sharing) all of which open successfully when using https and blocked correctly when using http.

Re: URL Filtering Doesn't work on HTTPS

PhoneBoy — Mon, 15 Oct 2018 00:36:14 GMT

In R77.30, I believe Categorize HTTPS Sites and HTTPS Inspection are mutually exclusive.

But if you're not using HTTPS Inspection, then you definitely need Categorize HTTPS Sites.

As for troubleshooting this, screenshots of "accepted" traffic you think should be blocked would be helpful.

Re: URL Filtering Doesn't work on HTTPS

Alex_Weldon — Mon, 15 Oct 2018 19:50:46 GMT

Also, like Dameon said, if users are using Chrome by default QUIC protocol is enabled and attempts to use udp/443 which cannot be inspected by Check Point so definitely check that out as well. It also seems to fit with HTTP blocks working and mixed results of HTTPS sites. You can check the in browser setting here: chrome://flags/#enable-quic