This article describes an issue where URL whitelist and blacklist entries configured under the default web filtering configuration are not enforced, while the same entries defined under a feature profile work as expected.

URL filtering behavior differs depending on where the configuration is applied:

• URL blacklist/whitelist configured under feature profile works correctly:

  set security utm feature-profile web-filtering url-blacklist bad
  

• URL blacklist/whitelist configured under default web filtering configuration does not work:

  set security utm default-configuration web-filtering url-blacklist bad

When the default web-filtering type is set to NG-Juniper, URL blacklist/whitelist entries defined in the default configuration are not properly matched.

 

This occurs due to the use of an incorrect profile ID during cache lookup, which prevents the system from hitting the local cache entries. As a result, queries are forwarded to the external server, and actions are applied based on server response rather than the locally configured blacklist/whitelist.

 

This issue has been addressed in Junos OS Release 24.2R2 and later. Upgrading to a fixed release resolves the incorrect profile ID handling and ensures that URL whitelist and blacklist entries configured under the default web filtering configuration are enforced as expected.