Why does one website get blocked but a similar one does not?

Hello SteveGross,

I'm not familiar with the UTM but ...
a similar one
on a higher level perhaps though badsite1 has reputation="malicious" categoryname="Malicious Sites" whereas badsite2 reputation="neutral" categoryname="Pornography", note also that for the former no reason tag is logged, for the latter it's reason="category". This might explain the different behaviour.

Christian

Thanks Christian.  I think this would mean that the emails get processed first by something other than the Default Block Policy.  Would anyone know what that is?

Hello SteveGross,

emails
emails? Isn't this about web and HTTP?
I hoped that some UTM expert (like Bob - BAlfson) would give a more helpful answer - just threw in my two cents when I saw that you query was unanswered for "many hours" [:)].

First of all, I noticed statuscode="502" together with error="Connection refused" in the first entry so maybe the destination did actually refuse the connection.
But anyway, I'd have thought that a blacklist/whitelist would have precedence - how did you add it to your policy?

Christian

Your customizations did not work.

"Connection refused" means that the connection was attempted, but the other end did not want to talk to you!   If it had been blocked by web proxy, the connect would not have been attempted.

*.badsites.com is not a valid regular expression for use in the Exceptions object.   Those must use regular expression syntax.

 The easiest way to get your desired result is to create a TAG for badstes.com with the box checked for "include subdomains", then create an exception object for "going to sites tagged as" that tag.

If an exception is applied, you will see an exceptions='feature,feature" or override='1" in the logs.  

As Doug said, Steve, the first access was not blocked "by" Web Filtering.  When you see statuscode="50?", you can assume that the web server doesn't like something about the proxy.  If this were an access you had wanted to allow, the first thing to try would have been an Exception for antivirus scanning.  When that doesn't work, the only solution is to skip the Proxy for  the site.

His advice too about tagging domains and subdomains is spot on.  I think you want to use that technique to Block on the 'Websites' tab of Filter Actions instead of allowing them in an Exception.  Use REGEX, not Windows notation in every place except email addresses.

Cheers - Bob