false detection of application since today 06:00am

[Wolfgang]

Starting today November 21. 06am (local time in Germany) we could observe a lot of false positives with application control/url filter. Most of legitimate traffic will be detected as "ExpressVPN". This application has risk level critical and will be blocked.

Interesting detail, only traffic related to proxy connections will be detect as "expressVPN". We can see this for connections proxy => proxy and between client and proxy

This view shows timeline of the application "expressVPN" only:

Anyone seeing same problem?

[mp2012]

Hi,

I can confirm this, same behaviour here. 

kind regards,

mp2012

[the_rock]

Trying to figure out if there is an easy way to test this in the lab with just one windows PC behind it...I did filter like below for 30 days in my lab and dont see anything, but will ask customer who runs app control to do it and see what they get.

blade:"Application Control" AND appi_name:ExpressVPN

[Wolfgang]

@the_rock it's only seen with involved proxy, without no problem !

[the_rock]

Ah, gotcha...never mind then.

[_Val_]

Do you have a TAC case for this?

[Wolfgang]

TAC case is open, R&D is working on it. Told me ther's a known issue with the application database.

[_Val_]

Is this resolved for you yet?

[mp2012]

Hi,

for me problem is solved now (environment with proxies involved too).

kind regards,

mp2012

[Wolfgang · Accepted solution]

@_Val_ problem is solved with an updated package for ApplicationControl/URLFilter from the last night. This was a little nightmare last day, because most of all Internet traffic was detected as "critical" and blocked. Teams, O365, sometimes www.google.de and  a lot more.

[_Val_]

I certainly understand, and I am sorry about it.