Description

This article explains why the whitelisted websites were inaccessible even when they were permitted by UTM local web-filtering and by security policies matching application junos-http/junos-https

Symptoms

*.jd.com was permitted by UTM local web-filtering using SNI performance mode while the other websites were blocked:

set security utm custom-objects url-pattern allow-list value *.jd.com

set security utm custom-objects custom-url-category cust-allow-list value allow-list

set security utm default-configuration web-filtering performance-mode

set security utm feature-profile web-filtering type juniper-local

set security utm feature-profile web-filtering juniper-local profile localprofile1 default block

set security utm feature-profile web-filtering juniper-local profile localprofile1 category cust-allow-list action permit

set security utm utm-policy test-policy web-filtering http-profile localprofile1


Security policy was configured to permit HTTP/HTTPs traffic and UTM policy was called:

set security policies from-zone trust to-zone untrust policy test match source-address any

set security policies from-zone trust to-zone untrust policy test match destination-address any

set security policies from-zone trust to-zone untrust policy test match application junos-http

set security policies from-zone trust to-zone untrust policy test match application junos-https

set security policies from-zone trust to-zone untrust policy test then permit application-services utm-policy test-policy


The flow session for JD.com access matched the configured test policy to permit web traffic but the website was still inaccessible.

Solution

It was found that DNS traffic was blocked and unable to resolve the JD.domain, which led to the web access failure.


After configuring permit policy for application junos-dns-udp, the traffic worked as expected:

set security policies from-zone trust to-zone untrust policy permit-dns match source-address any

set security policies from-zone trust to-zone untrust policy permit-dns match destination-address any

set security policies from-zone trust to-zone untrust policy permit-dns match application junos-dns-udp

set security policies from-zone trust to-zone untrust policy permit-dns then permit

Modification History

2025-10-22 : Article Created

Related Information

UTM Local Web Filtering to Block All Website Access Except Few Websites