WebBlocker Warn failure when cats=""
Hello!
I had a client (EDIT: running a T35 on 12.5 U1) get resumes.indeed.com blocked by WebBlocker when she clicked to view a person's resume. She got the standard Deny message, but it should have been a Warn message in my opinion, because it was due to what appears to be an unrecognized category:
Reason: Category '' denied by WebBlocker policy 'WebBlocker.Mgmt'
FSM traffic monitor shows in part:
ProxyDeny: HTTP Request categories (HTTPS-proxy-Mgmt.Out-00) HTTP-Client.Mgmt-DPI proc_id="http-proxy" rc="595" msg_id="1AFF-0021" proxy_act="HTTP-Client.Mgmt-DPI" cats="" op="GET" dstname="resumes.indeed.com"
Notice cats="" in the line above. Does that mean that the URL is uncategorized? If so, I have "URL unrecognized" set to Warn, but she got a Deny.
Another one is:
ProxyDeny: HTTP Request categories (HTTPS-proxy-Mgmt.Out-00) HTTP-Client.Mgmt-DPI proc_id="http-proxy" rc="595" msg_id="1AFF-0021" proxy_act="HTTP-Client.Mgmt-DPI" cats="" op="GET" dstname="8232301.fls.doubleclick.net"
There are multiple domains where I see cats="" in the line.
Is cats="" indicating unknown, uncategorized, or ???
Does anyone know what the reason is that I don't get the expected Warn message?
Gregg
EDIT: Egad! There are dozens of lines with cats="" in them in the FSM traffic monitor.
Here are a few:
2019-09-01 18:08:48 Deny src_ip=192.168.168.181 dst_ip=198.58.75.37 pr=https/tcp src_port=57187 dst_port=443 src_intf=1-VLAN1-PrivateLAN dst_intf=0-External msg=ProxyDeny: HTTP Request categories pckt_len= ttl= policy=(HTTPS-proxy-Mgmt.Out-00) proxy_action=HTTP-Client.Mgmt-DPI proc_id="http-proxy" rc="595" msg_id="1AFF-0021" proxy_act="HTTP-Client.Mgmt-DPI" cats="" op="GET" dstname="resumes.indeed.com" arg="/favicon.ico" geo_dst="USA" Traffic
2019-09-01 18:09:00 Deny src_ip=192.168.168.181 dst_ip=208.85.40.20 pr=https/tcp src_port=57195 dst_port=443 src_intf=1-VLAN1-PrivateLAN dst_intf=0-External msg=ProxyDeny: HTTP Request categories pckt_len= ttl= policy=(HTTPS-proxy-Mgmt.Out-00) proxy_action=HTTP-Client.Mgmt-DPI proc_id="http-proxy" rc="595" msg_id="1AFF-0021" proxy_act="HTTP-Client.Mgmt-DPI" cats="" op="GET" dstname="www.pandora.com" arg="/ping.txt?f=156738654044181988" geo_dst="USA" Traffic
2019-09-01 18:09:22 Deny src_ip=192.168.168.181 dst_ip=23.21.141.37 pr=https/tcp src_port=57209 dst_port=443 src_intf=1-VLAN1-PrivateLAN dst_intf=0-External msg=ProxyDeny: HTTP Request categories pckt_len= ttl= policy=(HTTPS-proxy-Mgmt.Out-00) proxy_action=HTTP-Client.Mgmt-DPI proc_id="http-proxy" rc="595" msg_id="1AFF-0021" proxy_act="HTTP-Client.Mgmt-DPI" cats="" op="GET" dstname="lt500.tritondigital.com" arg="/lt?guid=c3FSNIP" geo_dst="USA" Traffic
2019-09-01 18:14:58 Deny src_ip=192.168.168.181 dst_ip=198.58.75.37 pr=https/tcp src_port=57275 dst_port=443 src_intf=1-VLAN1-PrivateLAN dst_intf=0-External msg=ProxyDeny: HTTP Request categories pckt_len= ttl= policy=(HTTPS-proxy-Mgmt.Out-00) proxy_action=HTTP-Client.Mgmt-DPI proc_id="http-proxy" rc="595" msg_id="1AFF-0021" proxy_act="HTTP-Client.Mgmt-DPI" cats="" op="GET" dstname="resumes.indeed.com" arg="/static/f6fcSNIP/styles/resume-view-app.css" geo_dst="USA" Traffic
2019-09-01 18:14:58 Deny src_ip=192.168.168.181 dst_ip=74.125.197.156 pr=https/tcp src_port=57281 dst_port=443 src_intf=1-VLAN1-PrivateLAN dst_intf=0-External msg=ProxyDeny: HTTP Request categories pckt_len= ttl= policy=(HTTPS-proxy-Mgmt.Out-00) proxy_action=HTTP-Client.Mgmt-DPI proc_id="http-proxy" rc="595" msg_id="1AFF-0021" proxy_act="HTTP-Client.Mgmt-DPI" cats="" op="GET" dstname="stats.g.doubleclick.net" arg="/r/collSNIP" geo_dst="USA" Traffic
2019-09-01 19:07:28 Deny src_ip=192.168.168.181 dst_ip=172.217.5.196 pr=https/tcp src_port=55023 dst_port=443 src_intf=1-VLAN1-PrivateLAN dst_intf=0-External msg=ProxyDeny: HTTP Request categories pckt_len= ttl= policy=(HTTPS-proxy-Mgmt.Out-00) proxy_action=HTTP-Client.Mgmt-DPI proc_id="http-proxy" rc="595" msg_id="1AFF-0021" proxy_act="HTTP-Client.Mgmt-DPI" cats="" op="GET" dstname="www.google.com" arg="/gen_204?atyp=i&ct=rfl&cad=&ei=XnlsXb2zJrPN0PEP5N6HgAI&zx=1567390047292" geo_dst="USA" Traffic
2019-09-01 19:07:28 Deny src_ip=192.168.168.181 dst_ip=172.217.5.196 pr=https/tcp src_port=55024 dst_port=443 src_intf=1-VLAN1-PrivateLAN dst_intf=0-External msg=ProxyDeny: HTTP Request categories pckt_len= ttl= policy=(HTTPS-proxy-Mgmt.Out-00) proxy_action=HTTP-Client.Mgmt-DPI proc_id="http-proxy" rc="595" msg_id="1AFF-0021" proxy_act="HTTP-Client.Mgmt-DPI" cats="" op="POST" dstname="www.google.com" arg="/gen_204?atyp=csi&ei=hSNIP" geo_dst="USA" Traffic
2019-09-01 19:11:11 Deny src_ip=192.168.168.181 dst_ip=208.85.42.31 pr=https/tcp src_port=55112 dst_port=443 src_intf=1-VLAN1-PrivateLAN dst_intf=0-External msg=ProxyDeny: HTTP Request categories pckt_len= ttl= policy=(HTTPS-proxy-Mgmt.Out-00) proxy_action=HTTP-Client.Mgmt-DPI proc_id="http-proxy" rc="595" msg_id="1AFF-0021" proxy_act="HTTP-Client.Mgmt-DPI" cats="" op="GET" dstname="cont-5.p-cdn.us" arg="/images/public/rovi/albumart/9/4/9/7/SNIP.jpg" geo_dst="USA" Traffic
2019-09-01 19:11:19 Deny src_ip=192.168.168.181 dst_ip=23.21.141.37 pr=https/tcp src_port=55131 dst_port=443 src_intf=1-VLAN1-PrivateLAN dst_intf=0-External msg=ProxyDeny: HTTP Request categories pckt_len= ttl= policy=(HTTPS-proxy-Mgmt.Out-00) proxy_action=HTTP-Client.Mgmt-DPI proc_id="http-proxy" rc="595" msg_id="1AFF-0021" proxy_act="HTTP-Client.Mgmt-DPI" cats="" op="GET" dstname="lt500.tritondigital.com" arg="/lt?guid=c3FsSNIP" geo_dst="USA" Traffic
2019-09-01 21:43:45 Deny src_ip=192.168.168.184 dst_ip=23.65.184.80 pr=http/tcp src_port=55030 dst_port=80 src_intf=1-VLAN1-PrivateLAN dst_intf=0-External msg=ProxyDeny: HTTP Request categories pckt_len= ttl= policy=(HTTP-proxy-Mgmt.Out-00) proxy_action=HTTP-Client.Mgmt-DPI proc_id="http-proxy" rc="595" msg_id="1AFF-0021" proxy_act="HTTP-Client.Mgmt-DPI" cats="" op="GET" dstname="content.dellsupportcenter.com" arg="/mstr/pd.txt?pr=OptiPlex SNIP
Gregg Hill
Comments
Case - 01278320 has been opened for this issue.
Gregg Hill