Most URLs categorized as X-VPN this morning

[Marcel_Gramalla]

Hi,

we encountered a big issue this morning as nearly all URLs were categorized as X-VPN application which is blocked in our rulebase because of the category (Anonymizer) and it's also set to critial risk.

Did you encounter the same and is there any official statement? It's obviously an issue with the database and the first time we see such an issue. 

[Albin]

Hi,

We have the same issue. We had  this  the other day and just now again on one site.

[Daniel_Hainich]

hi,

we have the same issue since today.

[sascham]

Hello,

same issue here. It started around 04:12 AM CEST.

[Sebastian]

Hi all,

We have the exact same issue! Nothing is passing by as every web request is categorized as X-VPN and therefore blocked.

[Nenad_Odic]

We have this from this morning,is there  a reason why or we have to raise a TAC ticket? 

[tomaszek]

Yes, we have the same issue

[Stephan_Scholz]

Same here. Any comments from Check Point?

[Nenad_Odic]

Just raised   

Case

6-0003912005

so we will see if they come  up with an idea ,other that remove anonymizer category from rules.

[Josef_Maier]

Hi,

we have the same problem. We registered an ticket bye Check Point Support. At the moment no reaction. On the status Checkpoint website https://status.checkpoint.com/ there are all services OK. 

[_Val_]

Hi all,

We are aware of the miscategorization by Application Control / URL Filtering blade, where legitimate traffic is categorized as X-VPN and being dropped accordingly. Right now, a joint Task force that includes both R&D and TAC experts are working together to mitigate the issue.

We will keep you posted

[Nenad_Odic]

thank you Val,

hope you will sort it out

[_Val_]

I will update this post once we have a definitive fix.

[796570686578]

Thank you for your quick response!

Is it possible that you provide a status update in this thread as soon as you get the news that the issue has been resolved? That would would be amazing.

Appreciate you and best regards

[FedericoB]

I'm experiencing the same issue since this mornig. 

[vNenad]

Hey @_Val_.

This issue has caused disruption, and it raises a question about communication. While we understand technical problems occur, many partners rely on prompt notifications from Check Point to address such situations effectively.

I'd like to inquire why there wasn't a more immediate communication effort to partners regarding this miscategorization issue. Timely updates would have significantly aided troubleshooting and minimized disruption for many organizations. Are there plans to improve communication protocols for future occurrences?

In addition to the previous questions, I'm also interested in:

• Any recommended workarounds or mitigation strategies in the meantime.
• Whether there's an estimated timeframe for a resolution.

Thank you for your time and any information you can share.

Sincerely,
Nenad Vijatov

[Nigel_Costar]

Please can we have an update and ETA on the issue this is causing significant disruption for our staff and CP are being frustratingly quiet. the website reports there will be an update every 30 minutes but I do not see any posts regarding this?

[GeoMal86]

Same here... We have spent an hour thinking that our PCs were infected and trying to find what happened. 

This seems to only be happening on Harmony Connect?

Update: nvm, it's happening on all gateways.

[Tom_Hinoue]

It seems the issue is occurring for users that are using Full SSL Inspection.
We have a case open to TAC since yesterday but no updates yet.

I noticed X-VPN signature was updated on 8-Apr (Mon) in APPI package No. 070424_1.
If this is the case, then I hope a new package is released soon 🙂

[Vincent_Croes]

This is not the case. We do not use full ssl inspect and are still impacted. 

Question to Check Point, when can we expect an official statement?

[Tom_Hinoue]

Thanks for sharing.
It's strange because we have many customers but don't experience this issue with only HTTPS categorization... Note we do have Anonymizers to be blocked in the policy.

[Hugo_vd_Kooij]

Not so weird at all. The detection is based on a perceived header. Without HTTPS inspection you will not be able to look into that traffic to match this.

[Vincent_Croes]

Not 100% what you mean by this but we have multiple environments impacted that are not decrypting one bit of SSL. In other words, SSL inspection is not a pre-requisite to experience this issue. 

HTTPS categorization is enabled.

[Tom_Hinoue]

Thanks all for the insight 🙂
I was just wondering because that we have more than hundreds of customers, but only 3-4 reports from the field experiencing this issue, and it was just that all of those 3-4 customers had Full SSLINS enabled.

Btw, I just noticed there was a APPI package update No.110424_1 with just "X-VPN" updated.
Maybe the issue was addressed?🤔

[Nenad_Odic]

if you meant this one it does not help still traffic is x-vpn categorized

[nfinney1878]

Where do you see that "X-VPN" was updated?

[Tom_Hinoue]

I recieved a mail from APPWIKI_UPDATES just around an hour ago. I haven't checked on MGMT yet... probably the package is still not distributed to the update servers?

 

[EngineerActo]

Seems a bit more complicated than that. Incoming traffic to our own website's webservers with HTTPS-inspection and IPS also gets frequently blocked as X-VPN, but not all, even when the same URL's are requested. Not every browser triggers this protection, but mostly Chrome and MS Edge do.
Not all users are impacted by the issue, or many hours after others were inpacted by the issue. Hopefully it is NOT something that get's distributed to pc's with (cloud) shared/synchronized browser profiles, such as google and microsoft stored browser profiles.

[StefanSchmidt]

Same problem here, seeing this since April 8 4pm CEST

[Hugo_vd_Kooij]

Stefan, Did you open a service request yet? As you seem to be seeing this 2 to 3 days before most other see it.

And this is the sort of additional insight that might help finding a root cause.