topic Help: Site is being blocked but its in allowed domains. in Web Security

Help: Site is being blocked but its in allowed domains.

keithsauer507 — Thu, 13 Apr 2017 15:53:42 GMT

Our marketing team, and also I (IT) cannot order office supplies anymore trough www.wrigleysos.com.

Its in our allowed domains url list though, clearly you can see that below (I will bold it).

What is going on here?

Blocked Site:	www.wrigleysos.com
Blocked Category:	Allowed Domains
User:	DIAMONDCU\my admin user@windows
User Group:	BLOCK_WBRS_12-Information_Technology-Authenticated_Users-DefaultGroup-NONE-NONE-NONE

Blocked category but then it says Allowed Domains. Oxymoron much?

I opened a ticket with TAC.

keithsauer507 — Thu, 13 Apr 2017 16:33:08 GMT

I opened a ticket with TAC. Grep accesslogs for this seems to think its a phishing site? Wish this information was displayed back to us on our custom block screen.

1492097221.532 5 10.6.3.2 TCP_DENIED/403 0 GET http://www.wrigleysos.com/ "DIAMONDCU\marketinguser@windows" NONE/- - BLOCK_WBRS_12-Marketing-Authenticated_Users-DefaultGroup-NONE-NONE-NONE <C_Allo,-8.1,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,IW_shop,-,"-","phishing","Unknown","Unknown","-","-",0.00,0,-,"-","-",-,"-",-,-,"-","-"> - "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36"

1492098697.118 4 10.7.3.7 TCP_DENIED/403 0 GET http://www.wrigleysos.com/ "DIAMONDCU\ITuser@windows" NONE/- - BLOCK_WBRS_12-Information_Technology-Authenticated_Users-DefaultGroup-NONE-NONE-NONE <C_Allo,-8.1,-,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,IW_shop,-,"-","phishing","Unknown","Unknown","-","-",0.00,0,-,"-","-",-,"-",-,-,"-","-"> - "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36"

I think Cisco had to fix the

keithsauer507 — Fri, 14 Apr 2017 17:07:42 GMT

I think Cisco had to fix the WBRS. Its resolved.