Why Palo Alto Networks URL filtering test site is categorized not as "proxy-avoidance-and-anonymizers" but "computer-and-internet-info" wrongly?
3419
Created On 09/27/24 07:18 AM - Last Modified 04/14/25 23:43 PM
Question
- Trying to check URL Filtering test site urlfiltering.paloaltonetworks.com/test-Proxy-Avoidance-and-Anonymizers/
- The test site is not identified in the correct category of "proxy-avoidance-and-anonymizers"
- It is identified as "computer-and-internet-info".
Environment
- PAN-OS 10.1, 10.2, 11.0, 11.1, 11.2
- URL filtering
Answer
- When the URL is accessed normally with a browser, HTTPS is used instead of HTTP.
- Since recent browsers no longer display "http://" or "https://" in the address bar, it's difficult to distinguish which way is used.
{Acess bar in Google Chrome]
- When the URL is accessed with HTTPS, the URL field included in the "HTTP GET" is encrypted and the Firewall is not able to determine this.
- In that case, the Next-Generation Firewall refers to the SNI(Server Name Indication) field included in the SSL Client Hello.
- The SNI field only describes the hostname. Refer to the wireshark info below.
- As a result, the hostname "urlfiltering.paloaltonetworks.com" is categorized as "computer-and-internet-info".
- To use the URL Filtering test page, Use the full URL including "http://" or enable the Decryption feature.
[Client Hello capture decode on Wireshark]
Additional Information
- Refer to the URL Filtering Test Pages which includes "http://", which can be useful for testing URL categories.
- For SSL decryption, Refer to How to Configure SSL Decryption