This article explains why the whitelisted websites were inaccessible even when they were permitted by UTM local web-filtering and by security policies matching application junos-http/junos-https
*.jd.com was permitted by UTM local web-filtering using SNI performance mode while the other websites were blocked:
set security utm custom-objects url-pattern allow-list value *.jd.com
set security utm custom-objects custom-url-category cust-allow-list value allow-list
set security utm default-configuration web-filtering performance-mode
set security utm feature-profile web-filtering type juniper-local
set security utm feature-profile web-filtering juniper-local profile localprofile1 default block
set security utm feature-profile web-filtering juniper-local profile localprofile1 category cust-allow-list action permit
set security utm utm-policy test-policy web-filtering http-profile localprofile1
Security policy was configured to permit HTTP/HTTPs traffic and UTM policy was called:
set security policies from-zone trust to-zone untrust policy test match source-address any
set security policies from-zone trust to-zone untrust policy test match destination-address any
set security policies from-zone trust to-zone untrust policy test match application junos-http
set security policies from-zone trust to-zone untrust policy test match application junos-https
set security policies from-zone trust to-zone untrust policy test then permit application-services utm-policy test-policy
The flow session for JD.com access matched the configured test policy to permit web traffic but the website was still inaccessible.
It was found that DNS traffic was blocked and unable to resolve the JD.domain, which led to the web access failure.
After configuring permit policy for application junos-dns-udp, the traffic worked as expected:
set security policies from-zone trust to-zone untrust policy permit-dns match source-address any
set security policies from-zone trust to-zone untrust policy permit-dns match destination-address any
set security policies from-zone trust to-zone untrust policy permit-dns match application junos-dns-udp
set security policies from-zone trust to-zone untrust policy permit-dns then permit
UTM Local Web Filtering to Block All Website Access Except Few Websites