Description

Category "Enhanced_Games" should be allowed but it's being blocked. This category doesn't have a block action in the UTM feature profile configuration, and should also be permitted per site reputation.
 

{primary:node1}

user@hostame> test security utm enhanced-web-filtering url-check www.example1.net

 UTM enhanced-web-filtering URL-check result:

  Enhanced web-filtering server:

    rp.cloud.threatseeker.com

  Test result for URL check:

    Category name: Enhanced_Games

    Reputation: 94

    Reputation level: very safe

Symptoms

URL blocked due to UTM default base-filter category-action mapping.

Solution

Use verification command "show security utm web-filtering category base-filter" to confirm if the URL is being blocked due to the base filter:

user@hostame> show security utm web-filtering category base-filter

node0:

--------------------------------------------------------------------------

Category updater result: Category updater not enabled on secondary box.

 

node1:

--------------------------------------------------------------------------

 

 Base-filter: ewf-default-filter

.....

   Enhanced_Games                                                        block

.....

 

By default, the EWF processes a URL in the order of blocklist, allowlist, custom category, and then predefined category. (https://www.juniper.net/documentation/us/en/software/junos/utm/topics/topic-map/security-utm-web-filtering.html#id-understanding-enhanced-web-filtering-process)

Since the Enhanced_Games category is not specified in an allowlist or user profile, the predefined category is kicking in and blocking it. This is due to the following configuration:

 

  utm {

    custom-objects {

      base-filter {

        ewf-default-filter {

          value Predefined-filter-value;

        }

      }

 

User can either add the "Enhanced_Games" category to the feature-profile with a permit action:

# set security utm feature-profile web-filtering juniper-enhanced profile <profile-name> category Enhanced_Games action permit
 

Or, customer could also configure a custom whitelist using:
 

# set security utm custom-objects url-pattern <white-list-name> value http://www.example1.net

# set security utm custom-objects custom-url-category <custom-white-list> value <white-list-name> 

# set security utm feature-profile web-filtering url-whitelist <white-list-name> 

# set security utm feature-profile web-filtering juniper-enhanced profile <profile-name> category custom-url-category action permit

 

Note: If you want to permit the whole category rather than specific URLs my suggestion is to edit the current feature profile. The whitelist is more useful when you have multiple URLs or IPs that don't necessarily belong all to the same category, but should all be allowed.

Modification History

11/2: Changed status to non-validated

11-9-2023: Formatting corrections made.
11-22-2023: Formatting corrections made.