This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Am not getting expected filtering results...

Hello All,

I cannot block all HTTPS sites except explicitly defined HTTPS sites...

I want to create a filter for a specific user (host actually) to ONLY be able to access online banking, Google (to search for banking sites only) and mail (Gmail, Yahoo mail and Hotmail) Here is what I tried.

1. Checked the “Scan HTTPS(SSL) Traffic” on Web Protection\Web Filtering Global Tab

2. Created a Filter Action
Name: “Google with Banking,gmail,yahoo,hotmail”
Mode: Block by default
Threshold: Off
Allow these website catagories: Finance/Investing
Allow these URL sites:
Name: “Google with Banking,gmail,yahoo,Hotmail”
Domains: Left this Blank
https://www.google.com/
https://mail.google.com/
http://mail.yahoo.com/
[url=http://www.hotmail.com/
Checked “Use Antivirus scanning”

3. Created a new filter action:
Name: “Google with Banking,gmail,yahoo,hotmail allways”
Allowed Users/Groups: Left this one blank
Time Event: Allways
Filter Action: “Google with Banking,gmail,yahoo,hotmail”

4. Created a Proxy Profile
Name: “Client IP 192.168.2.5”
Position: 1 (only one profile so far)
Source Networks:
Name: “Client IP 192.168.2.5”
Type: Host
IPv4 Address: 192.168.2.5
Filter Assignments: “Google with Banking,gmail,yahoo,hotmail allways”
Fallback Action: Default Filter Action
Operation Mode: Transparent
Authentication Type: None
Full Transparent mode: Did not check this
Scan HTTPS(SSL) Traffic: Did not check this

This works well to access the URLS listed in the filter action (Step 2. Above) and blocks all URLS using HTTP protocol but it DOES NOT block any URLS starting with HTTPS protocol.
When I also check the “Scan HTTPS(SSL) Traffic” on the “Client IP 192.168.2.5” Proxy Profile object, HTTPS sites are blocked but so are my allowed sites as defined in the “Google with Banking,gmail,yahoo,hotmail” Filter action (Step 2 above).
Can anyone see what I am doing wrong here?
Thanks!

This thread was automatically locked due to age.

Parents

0 Michael Dunn over 11 years ago

You should have "Scan HTTPS" turned on.

Under "Allow these URLs" this should be a series of Regular Expressions.

Try this tool on how to build a regex for a URL.
Quick RegEx for URLs | UTM Tools

Note that Google also has mail.google.com and other hostnames, and if you are outside of the US you may need to handle regional variations (such as google.de).

To simplify things slightly, you can also go to the Proxy Profile and set the Fallback Action to the "Google with..." Action. You can then delete the Filter Assignment - it isn't needed. All traffic from that host will use the Fallback and your new Action.
Cancel
Vote Up 0 Vote Down

Cancel
0 saxitalis over 11 years ago in reply to Michael Dunn

Thanks for the reply Michael but I still don’t see what I am doing wrong here… I did try to turn Scan HTTPS(SSL) Traffic to ON (see below)

I would like to filter all HTTP and HTTPS traffic except the defined HTTP and HTTPS sites in my policy. I am able to filter the HTTP but not HTTPS traffic correctly.

I simplified for a test:

Filter Action:
Name: “Block all HTTP/HTTPS but google and Yahoo mail”
Mode: Block by default
Threshold: Off
Allow these website categories: None selected
Allow these URL sites:
Name: “google and yahoo only”
Domains: Left this Blank
Regular Expressions:
^https?://([A-Za-z0-9.-]*\.)?google.com/ (SHouldn’t this RE allow all flavours of the google domain?)
https://www.google.com/
Google
http://mail.yahoo.com/

Proxy Profile:
Name: “Client IP 192.168.2.5”
Position: 1
Source Networks:
Name: “Client IP 192.168.2.5”
Type: Host
IPv4 Address: 192.168.2.5
Filter Assignments: None selected
Fallback Action: “Block all HTTP/HTTPS but google and Yahoo mail”
Operation Mode: Transparent
Authentication Type: None
Full Transparent mode: Did not check this
Scan HTTPS(SSL) Traffic: Tried this turned on and turned off (see below)

1. When Scan HTTPS(SSL) Traffic is turned OFF
Results:
Only defined HTTP traffic is allowed (Google and Yahoo mail)
All HTTPS Traffic is allowed (only defined HTTPS should be allowed)
2. When Scan HTTPS(SSL) Traffic is turned ON
Results:
It seems ALL HTTP and HTTPS traffic is blocked

Can anyone see what I am doing wrong here?
Thanks!
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 saxitalis over 11 years ago in reply to Michael Dunn

Thanks for the reply Michael but I still don’t see what I am doing wrong here… I did try to turn Scan HTTPS(SSL) Traffic to ON (see below)

I would like to filter all HTTP and HTTPS traffic except the defined HTTP and HTTPS sites in my policy. I am able to filter the HTTP but not HTTPS traffic correctly.

I simplified for a test:

Filter Action:
Name: “Block all HTTP/HTTPS but google and Yahoo mail”
Mode: Block by default
Threshold: Off
Allow these website categories: None selected
Allow these URL sites:
Name: “google and yahoo only”
Domains: Left this Blank
Regular Expressions:
^https?://([A-Za-z0-9.-]*\.)?google.com/ (SHouldn’t this RE allow all flavours of the google domain?)
https://www.google.com/
Google
http://mail.yahoo.com/

Proxy Profile:
Name: “Client IP 192.168.2.5”
Position: 1
Source Networks:
Name: “Client IP 192.168.2.5”
Type: Host
IPv4 Address: 192.168.2.5
Filter Assignments: None selected
Fallback Action: “Block all HTTP/HTTPS but google and Yahoo mail”
Operation Mode: Transparent
Authentication Type: None
Full Transparent mode: Did not check this
Scan HTTPS(SSL) Traffic: Tried this turned on and turned off (see below)

1. When Scan HTTPS(SSL) Traffic is turned OFF
Results:
Only defined HTTP traffic is allowed (Google and Yahoo mail)
All HTTPS Traffic is allowed (only defined HTTPS should be allowed)
2. When Scan HTTPS(SSL) Traffic is turned ON
Results:
It seems ALL HTTP and HTTPS traffic is blocked

Can anyone see what I am doing wrong here?
Thanks!
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data