Blocking sites doesn't work as intended

[JPR]

Hi all,

I have rule that blocks Google Cloud Platform that consists of an inline rule that allows traffic to the following URLS in order for a specific site to work properly:

storage.googleapis.com/trafikkort-data/

storage.googleapis.com/trafikkort-tiles/

It's an allow rule with a Custom Application Site like this:

The actual URLs is more than that, so e.g. storage.googleapis.com/trafikkort-data/something/something/something.json

In the logs it seems as by allowing these two URLs above I am allowing other traffic to storage.googleapis.com/something/something as well, which is not what I want.

I have tried several ways of formatting and posts here and sk106623, but doesn't seem to get it right.

If anyone knows what it takes, it'd be much appreciated 🙂

[the_rock]

I would simply try *googleapis* or something like that, as long as you are sure you want to block everything from those sites. Maybe try that for one or group of users and test.

Andy

[JPR]

I'll have to look into that on Monday. Thanks though!

[CheckPointerXL]

Path after FQDN is not relevant/supported in my knowledge

did you try regex?

please take a look here too https://support.checkpoint.com/results/sk/sk174194

[the_rock]

Not sure how relevant it is, but Im sure it is supported.

[JPR]

I'll have to look into that on Monday. Thanks!

[the_rock]

Forgot to ask, do you have ssl inspection enabled?

Andy

[JPR]

Yes, using HTTPS Inspection.

[the_rock]

In my experience, cause this might be easy to overlook, make sure its not bypassed in https inspection policy. 

Andy