URL Filtering Not Blocking Some Categorized Sites

[RemoteUser]

Hi everyone,
I'm facing a rather strange issue. I have a Check Point gateway running R81.20 with JHF-24, deployed in Azure, and it's not blocking certain websites even though they clearly fall under the specified URL filtering categories.

This gateway is not using a proxy, and we have already set the URL Filtering mode to "Hold", but the issue still persists.

Has anyone experienced something similar or can offer some guidance?

Thanks in advance!

[Chris_Atkinson]

Please confirm if SSL inspection is active?

Additionally the usual additional suggestions without knowing specifics would be to upgrade the JHF take and confirm QUIC traffic is blocked.

[RemoteUser]

HTTPS inspection is not enabled,
This is the rule that blocc traffic:
source: some network >  dst: RFC 1918 Negated  > service: Weapons Hate Sex.....  > drop log accounting

[_Val_]

Can you please make a screenshot of this rule? Something is not clear.

Also, can you provide examples of specific URLs that are not blocked?

[RemoteUser]

I mask the network.
This for example  porn300

[PhoneBoy]

When traffic is not blocked, what rule is the traffic accepted on?
Please provide a screenshot of the full log card (with sensitive details redacted) of such accepted traffic.

[the_rock]

That rule  should work, just wont give block page, if inspection is off, since there is nothing to intercept.

What rule does it get accepted on?

Andy

[RemoteUser]

Hi Brother,

I remembered a site that wasn’t being blocked , porn300.com.
This site falls under the Sex category, according to the classification:

For: http://porn300.com
Current Categories: Sex, Pornography, Medium Risk

I don’t see it appearing in the logs anymore, but I can assure you it wasn’t the only one. You could access it freely and browse without restrictions.
On the other hand, sites like Pornhub were blocked completely and couldn’t be accessed at all.

[the_rock]

Just add custom app site and include *porn300*
Andy

[Chris_Atkinson]

No point playing whack-a-mole, probably best to patch for the general issue that exists below JHF T65 i.e.

The "Categorized HTTPS Sites" option does not classify specific websites when "TLS 1.3 hybridized Kyber support" is enabled in the browser

[RemoteUser]

I don't think the jumbo resolves the issue, since we're experiencing the same problem with another cluster running JHF 84.
As indicated here https://support.checkpoint.com/results/sk/sk182318.

[Chris_Atkinson]

Suggest you methodically work the issue through with TAC in that instance and understand the differences.

To me it makes little sense to waste time troubleshooting with such an early JHF with known issues in the first instance.

[RemoteUser]

You're right, url filtering work better with https inspection enbaled. period.

[the_rock]

100%

[Chris_Atkinson]

@Lesley has linked it below but a likely explanation is sk182318 fixed in later JHF.

[Lesley · Accepted solution]

If HTTPS inspection is not enabled you need to enable the ''light'' version. Please check if feature below is enabled:

If this is enabled look into this SK: https://support.checkpoint.com/results/sk/sk182318

Your version is to old and could use Jumbo update. 

After that also update your CA list: https://support.checkpoint.com/results/sk/sk64521

[RemoteUser]

Hi brother

Yes, I saw that it's enabled (light version). Most likely, the first SK you sent me is the explanation , it could clarify why some sites are allowed through while others are blocked.