Problem with sites getting categorized as Low Risk...

JPR · ‎2024-03-12

Hi,

Our firewall are blocking "Low Risk" sites even though we do not block "Low Risk" as a category and according to Check Point's online URL Categorization the site it isn't "Low Risk".

E.g. bedrevejr[.]dk gets categorized by our firewall as "Low Risk" and gets blocked:

But by checking it online it gets categorized as "News / Media":

It hits a rule in our rule set where we block various categories, however, as mentioned above we do not block "Low Risk" as a category. Does anyone know what is going on and perhaps how it can be solved?

This is just an example. We have experienced it with other sites as well. Sometimes the "Low Risk" category just disappears and we can access the site site again and then the next day it's categorized as "Low Risk" and gets blocked. For some sites I have whitelisted them, however, I don't see that as a viable solution.

Thanks!

George_Ellis · ‎2024-03-12

You are not alone. It is an ongoing issue for us and has been in escalated with no joy.

PhoneBoy · ‎2024-03-12

Can you show a log card (sensitive details redacted) of something that is getting blocked in this manner?

JPR · ‎2024-03-12

Hi PhoneBoy,

Yeah, it looks like this:

I had actually whitelisted the site, however, it's still categroized as "Low Risk".

JPR · ‎2024-03-12

And here's the HTTPS Inspection:

JPR · ‎2024-03-12

And at the moment lego[.]com is also categorized as "Low Risk":

the_rock · ‎2024-03-12

Can you bypass it in https inspection policy to see if same issue persists?

Best,

Andy

George_Ellis · ‎2024-03-12

I know we are not doing https inspection in the base configuration. And in the HTTPS Inspection policy it stated that it will only be enforced if it is enabled.

the_rock · ‎2024-03-12

See if this post helps.

Andy

https://community.checkpoint.com/t5/Management/Lots-of-sites-being-categorized-as-anonymizers-inc-Sp...

Specially this update from Jennifer:

Please find update from Checkpoint below :

'Currently, we have received multiple complaints about this issue and it was brought to the highest ranks in support and R&D departments, this issue is related to CP side and is being handled as we speak by our internal teams,

We appreciate your patience and cooperation in reporting this issue.
I will update you on the progress and possible steps to solve this issue once I get news from R&D'

Any news on the fix? I have a case open and got the same "known issue" response.

they have said a new application control db has been uploaded to the Gateways (but not the Management server), dated 05/03/2024 time 10:3x Update number 050324_3, which I've checked is now there. (cpview/Software-Blades/Overview-Updates Information:)
I am having a look now but Bing and open.spotify look good so far.

George_Ellis · ‎2024-03-21

One of my co-workers just spotted this one (and it will get blocked)

George_Ellis · ‎2024-03-21

Thank goodness for working from home and split tunneling.

Are you a member of CheckMates?

Problem with sites getting categorized as Low Risk and blocked