Hi all,
I'm running into inconsistent behavior between category-based Application Control/URL Filtering blocking and custom domain object blocking, and I'd appreciate some insight.
Setup:
- HTTPS Inspection is enabled and working (confirmed via logs — SNI and TLS version are correctly captured for the blocked connections).
- Single unified Access Control rule with:
- Predefined categories (Shopping, Media, Remote Administration Tools, etc.)
- Manually added Custom Application/Site objects for specific domains (e.g., x.com, *.x.com, y.com)
- QUIC application also blocked in the same rule
- Action: Block, with a UserCheck "Ask/Inform" message attached
Behavior:
When a site is blocked purely by category (e.g., site Z under "Media"), the UserCheck block page displays correctly in the browser.
When a site is blocked by my Custom Application/Site object (e.g., site X, site Y), the browser instead shows:
"This site can't be reached — www.x.com unexpectedly closed the connection. ERR_CONNECTION_CLOSED"
No UserCheck page is displayed at all — just a hard connection reset.
What I've already ruled out:
- HTTPS Inspection Policy: the traffic is confirmed hitting an "Inspect" rule, not Bypass.
- QUIC/UDP 443: already blocked in the same rule, so it's not a QUIC-bypass issue.
- Action/rule configuration: identical Action (Block + UserCheck) is used for both the category rule and the custom object rule — same rule, same layer.
- Logs show HTTPS Inspection is reading the SNI and TLS version correctly (TLS 1.3, SNI: www.x.com), so the gateway is clearly seeing the connection.
My question:
Is this expected behavior — i.e., does the gateway enforce Custom Application/Site domain matches via early SNI-based blocking during the TLS handshake (before full HTTPS Inspection/decryption completes), while category matches require full decryption and therefore can serve the UserCheck page? If so, is there a supported way to make custom domain objects go through the same full-inspection pipeline as categories so the UserCheck page displays consistently?
I tried recreating the domains as a Custom Category instead of individual Custom Application/Site objects, but this didn't resolve the issue (and the exact menu options I expected weren't available/matching in my version of SmartConsole either).
- Gateway version: R82, running the latest hotfix / Jumbo HFA
Any pointers — especially from anyone who has hit this exact SNI-vs-full-inspection distinction — would be much appreciated.
Thanks!
