topic Re: Site URL not able to access in General Topics

Site URL not able to access

Gim_Dor — Wed, 04 Jul 2018 01:38:08 GMT

Hi there, I created an application filtering policy to be allowed and am able to ping the destination IP address for the site url which is international but unable to access it. There is a possibility of dns issue or it could be a firewall policy issue. Has any encountered this issue? How to resolve this so I am able to access that international site? Thanks.

Re: Site URL not able to access

Demith_Samaraw2 — Wed, 04 Jul 2018 06:46:05 GMT

It could be multiple reasons, but basic troubleshooting should be able to narrow-down the reason.

what version of the management and firewall is this,

is the firewall in transparent or proxy mode

do you see anything in the tracker logs?

can the URL be accessed without the CheckPoint policy?

Re: Site URL not able to access

_Val_ — Wed, 04 Jul 2018 08:06:55 GMT

Hi Gim,

you have already listed two main reasons for it not to work: DNS resolution on the GW or FW policy in place that does not allow such connectivity. There might also be the third reason: the client itself goes via third party proxy and does not cross your FW in question.

I would suggest to start with two first assumptions.

1. Check DNS resolution for the specific FQDN is working of the FW enforcement point.

2. with curl, try to open URL in question directly from FW

3. If both 1 and 2 are working for you, start looking into connectivity and policy issues between the Web client and FW. You can use "fw monitor" to do so

I hope this helps. Please let me know how it goes.

Re: Site URL not able to access

Gim_Dor — Wed, 04 Jul 2018 15:58:39 GMT

Thank you Valeri and Demith for your response. After further digging, I found that there was a Geo-protection set in place for that country. I allowed it but then I was able to access the entire country's any site url. In order to only allow that particular website, I created a profile and set based on the IP address to be allowed and now, I am not even able to ping that IP.