FW is not consistency

[Tai_Bui]

Hi,

I am a junior in the security field. I received a ticket that one of my user couldn't get to a website (ex: greenrayindustries.com). I am located in California and able to access to it without a problem with my FW, but whomever aren't lived in Cali , the FW sometime blocks it sometime does not. I checked FW configuration and policy; they all were the same. I already check URL and it's not blacklist. I am not sure what should I do here. Any advise?

Thank you.

[Jeff_Engel]

Hi Tai,

Do you have any other software blades enabled besides FW?  Do you see any logs that appear to be related to this dropped traffic?

[Tai_Bui]

HI Jeff,

Yes, we enabled URL filtering and others. When I checked, here what I got:

Allow

https Traffic Allow from XXXXX to greenraytoday.com (66.147.244.221)

Log Info

Origin: California FW

Time: XXX

Blade URL Filtering

Product Family Access

Type Log

Application /Site

Application Name: greenraytoday.com

Primary Category Business/ Economy

Additional Categories: Business /Economy, URL Filtering

Application Risk -Unknown

Traffic

Destination greenrayindustries.com (66.147.244.221)

Destination Country United States

Services https (TCP/443)

Bock

https Traffic Blocked from XXXXX to 66.147.244.221(66.147.244.221)

Log Info

Origin: California FW

Time: XXX

Blade URL Filtering

Product Family Access

Type Log

Application /Site

Application Name: 66.147.244.221

Primary Category Spyware/Malicious Sites

Additional Categories: Spyware /Malicious Sites, High Risk, URL Filtering

Application Risk -4 High

Traffic

Destination greenrayindustries.com (66.147.244.221)

Destination Country United States

Services https (TCP/443)

[PhoneBoy]

You shouldn't see different results from different locations.

Please open a TAC case so we can properly investigate.