Description

Some websites are properly blocked by EWF and some others are not.

Symptoms

  • Some Websites are blocked properly by EWF and some others are not.
  • Chrome and Edge were recently updated.
  • Older versions of them work properly and block as expected.

Solution

Issue relates to a newer feature introduced on these 2 major browsers.

Some 3rd party websites already described on this and the way they can be disabled so EWF categorization works properly again.

This is not an issue only to Juniper devices. It's a new feature affecting all vendors since SNI field from the TLS handshake used by these filtering capabilities in order to classify sites properly, is now being encrypted by this new feature. The temporal workaround is to disable it.

chrome://flags/#enable-tls13-kyber
edge://flags/#enable-tls13-kyber 

For a permanent fix, Issue has been addressed by PR1806786 https://prsearch.juniper.net/problemreport/PR1806786

Modification History

2024-05-22 : Article Created

2025-02-06: PR added to Article