Same Websites blocked and allowed in wrong catagory

Hi,

Which version of XG are you using?
ian

Hi 

Thanks for your reply.

It's Sophos XG210. 

running XG ver?

ian

Hello Sarvesh Singh,

Thank you for reaching out to the community, SFOS uses SXL server's URL is 4.sophosxl.net. which communicating on Port TCP 443.
Currently on the categorization lookup for the site: Web.workline.hr it is categorized to business !!
=====================================
if you think that is incorrectly configured you may submit a request: support.sophos.com/.../filesubmission
 

It's 19.0.1- mr1

Hi, 

Thanks for your reply. 

This is not about website catagory, the problem is when network DLP is connected then it is blocking unusually. Sometime it detects in hrms or sometime business catagory. 

Hello there,

If your Network DLP is the one changing the category, I would be inclined to create a static category for this website in your Network DLP or allow both categories in the Sophos Firewall.

Regards,

Hi, 

Thanks for your reply. 

My Network DLP (transparent proxy) just monitors the packets sent from endpoints. And my network DLP does not have any option for url or catagory filtering. How do I check what is changing and why firewall is detecting same url in 2 different catagories.

May be it is because those urls are not in the global database of Sophos? 

Please reply.. 

When you say "this website comes under the hrms category" does that mean you have created a custom category for to match this website?

If so, then the website is actually both "hrms" (your custom category) and "business" (the real category from cloud lookup).  It will match the first web rule for either traffic.

So if your web rules are:

Allow hrms
Block business

Then it will allow it and say that it is hrms.

If your rules are:

Block business
Allow hrms

It will block it and say it is business.


Make sure that all the web policies you are using have rules that will apply to hrms first.