Description:

This article provides step-by-step troubleshooting guidance for UTM Web Filtering issues where all websites are being allowed, including those configured with a "block" action. It helps identify configuration, licensing, connectivity, or software-related causes and provides guidance to restore proper web-filtering functionality.

Perform the following verification steps to identify and resolve Web Filtering issues on the SRX device:

1. Verify the Web-Filtering License

Confirm that a valid Web-Filtering license is installed on the device:

show system license

Ensure the Web-Filtering license is present and has not expired.

2. Check ThreatSeeker Cloud (TSC) Status

Verify the connectivity and operational status of the ThreatSeeker Cloud service:

show security utm web-filtering status

• If the status shows Down, troubleshoot connectivity between the SRX device and the ThreatSeeker Cloud servers.
• Verify DNS resolution, routing, internet connectivity, and any firewall policies that may prevent communication.

3. Review UTM Configuration

If the TSC status is Up, review the UTM Web-Filtering configuration:

• Verify the configured UTM feature profile.
• Confirm that any custom URL categories contain the correct URLs.
• Ensure the intended actions (permit, block, log, quarantine, etc.) are configured correctly for both custom and predefined categories.

Useful commands:

show configuration security utm
show configuration security utm feature-profile web-filtering

4. Verify UTM Policy Mapping

Ensure the appropriate UTM policy is attached to the relevant security policy.

Example verification:

show configuration security policies

Confirm that the expected UTM policy is referenced under the applicable security policy rule.

5. Check Web-Filtering Statistics

Review Web-Filtering statistics and counters to determine whether requests are being processed by the UTM engine:

show security utm web-filtering statistics

Analyze the counters for:

• URL lookups
• Allowed requests
• Blocked requests
• Category matches
• Errors or lookup failures

6. Validate Operation with Logs

If the configuration appears correct, review security logs for Web-Filtering events:

show log messages | match utm

or check configured security logging destinations for URL filtering actions and errors.

Expected Outcome

After completing the above checks, you should be able to determine whether the issue is related to:

• Licensing
• ThreatSeeker Cloud connectivity
• UTM feature profile configuration
• URL category configuration
• Security policy/UTM policy mapping
• Web-Filtering processing failures indicated by statistics or logs.