Url categorization issue specific sites

[D_W]

Hi,

quick question about Application and URLFiltering without HTTPS Inspection on R80.10.

We block category "web-advertisement" and at the moment when someone tries to access https://fontawesome.com it get's blocked and we only see that "ad-balancer.at" in the SmartLog is getting blocked in that session.

Anyone with the same behaviour?

KR
David

[Daniel_Taney]

It looks like Check Point's only categorization for this site is "Computers / Internet". Are users attempting to access it by directly entering in that URL? Or are they searching for it and clicking on a search result?

One side effect I've seen from blocking the "Web-Advertisement" category is that many of the "top" links on Google (which are actually Ad hits) will not work.

If they are going directly to the URL, it could be that some portion of the site is redirecting to some ad or click-tracker before going to the actual webpage. If that is happening, there may not be much you can do besides white-listing "ad-balancer.at". Which I'm sure you don't want to do, but a poorly engineered website may not leave you a choice.

[D_W]

Thanks for your reply. Yes only solution for now was to allow ad-banners.at.
I couldn't find the redirect to ad-banner.at or similiar sites on this website "fontawesome.com". Other websites are affected too. So i think there is another issue.

Also what's the best practice then to filter out web-ads?

[Daniel_Taney]

I haven't found a better way to get around this besides accepting the reality that blocking this category will break a few websites and some exceptions may have to be put in. The way I see it, there is so much ad traffic on the Internet that, even with a few exceptions, you are probably still blocking more than you'll end up allowing by not filtering the category entirely.

[PhoneBoy]

There are many browser plugins that do this quite effectively.
Obviously that doesn't scale to the network very well. 😛

[Daniel_Taney]

If you have Identity Awareness configured, you could also write an Identity rule to allow those ad-sites for the users that need the website to work.