Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 7 replies
  • Subscribers 3 subscribers
  • Views 7157 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Unresolved URLs (Zscaler) are blocked in Web Filtering with "Host not found" - exception possible ?

RanX

Dear Community,

as we need to support many customers via VPN, I often have to deal with setting rules,
to allow VPN Clients to connect to remote sites from inside our network.

Always easy until now:
A customer came up with the Zscaler Client and I wasn't able to make settings for this connection to my satisfaction.
I only get it working, when I disable Pharming Protection, which is not what I want !

Here the Details:
Regarding, what I can see on the Web Filter Log, Zscaler seems to connect in two stages
- first it connects to the Zscaler endpoint at the customer's site and promts me to login
- when this is done, it tries to connect to some URL of the Zscaler infrastructure "https://driv.com.c2.prod.zpath.net/"

And that's where the UTM (V 9.605-1) breaks it.
The URL seems to be some kind of "virtual URL", which is not resolvable.
Even an online DNS lookup delivers no result.
So Web Filtering blocks the attempt of the Client, to contact this URL with the error "Host not found"

Now it would be nice, to simply disable the URL check for this very URL.

But no matter what exception or bypass I define in the Web Filter Rules - block action takes part before regarding any exclusions.
The only way, to get around is, to disable Pharming Protection.
To me this is no real solution, as I totally disable a security feature, instead of configuring an exception just for this URL.

The issue is similar to the behaviour described in this thread

Any ideas how to resolve this issue are highly appreciated

Best Regards  RanX



This thread was automatically locked due to age.
Parents
  • 0

    Hi  

    If you know which DNS server would resolve this, you may configure a DNS request route for this domain (which might require some assistance from Zscalar) and that will allow you to work with this. Since the DNS resolution is not possible, there is no point creating an Exception (even in Transparent mode Skip list).

    Regards

    Jaydeep

  • 0 in reply to Jaydeep

    Hi Jaydeep,

    so far in theory ...

    As even the official Zscaler DNS servers do not resolve this, I assume, this design is intended.
    Zscaler offers "cloud security" and therefore is kind of competitor to Sophos.
    I'm afraid, they won't bother that much about resolving issues on other vendors products.

    And even if I find a workaround with Zscaler, this is still no solution.
    When you read the other thread, I referred to, you will see, Zscaler is not the only case where unresolvable URLs are used.

    Thus it would make more sense, to set an exception on the UTM, than blame it to third parties, which won't care about it anyway ...

    Best Regards

    RanX

Reply
  • 0 in reply to Jaydeep

    Hi Jaydeep,

    so far in theory ...

    As even the official Zscaler DNS servers do not resolve this, I assume, this design is intended.
    Zscaler offers "cloud security" and therefore is kind of competitor to Sophos.
    I'm afraid, they won't bother that much about resolving issues on other vendors products.

    And even if I find a workaround with Zscaler, this is still no solution.
    When you read the other thread, I referred to, you will see, Zscaler is not the only case where unresolvable URLs are used.

    Thus it would make more sense, to set an exception on the UTM, than blame it to third parties, which won't care about it anyway ...

    Best Regards

    RanX

Children
Unfiltered HTML