topic Re: WSA S695 running IOS 11.8 - posting a video to facebook via https://rupload.facebook.com in Web Security

WSA S695 running IOS 11.8 - posting a video to facebook via https://rupload.facebook.com

mac987 — Fri, 24 Apr 2020 09:31:46 GMT

We are running IOS 11.8 on a WSA 695 and our users are trying to upload ( POST ) a video to facebook

The access policy allows access to the ' social networking ' URL category but the session seems to ignoring the access policy and hitting the global policy

2 log entries below with the client IP address redacted

the 1st log entry shows the user has access to the website https://rupload.com via the allow_social_media

the 2nd log entry shows the POST failure hitting the global policy

All advice help is much appreciated

thanks

Graham

1st log entry successfull access to the site 200 http response

1587647301.885 231 9.9.9.9 TCP_MISS_SSL/200 359 GET https://rupload.facebook.com:443/fb_video/d250fc249ffb1d8e81239470faf545c4-0-4893928?fb_dtsg_ag=AQy-o7O2z_YhgWCG11EoJLJUN4ThFfttBG4kPEsIm_VCPw%3AAQzerrpyrd2WY5JH-pWaONZJMcZ-HXrXS1bp8Wr32Jj_8Q&__user=758458578&__a=1&__dyn=7AgNe-4amaWxd2u6aJGi9FxqeCwKyaF3oyiFt94WqK4VEjwCzob4q5-agjGqK6otyEnCG2S8BDyUJu9xK5uF8iBCBXxWAcUa8iyEmzUggOi8wJAAhfypfBzogxCcyF8OESqt1l0gFohGVoyaxG4oO3OEljx-q9CJ4geJ3UWeCxryoaQ2CuqdxC4UryFFEy2mq4rGmmUS695UCWxyq9BQnjGu2Zumm2-bKqifyoOmi6o4S4e5aGfKi4XU8EkGexTzEymcAUG2HXxKiQhxfyopxny-cBK6ojx22iaxCbryu290yy8vgKfAmFoyvChHAy9ooyUgAzF8GWzU4pet7Gmu48y22UsDCG69Adxp2UtDAAzkczp8syUy4Egxi48rwPDxqF8kxa68lG76u4U4aEWi8xi8LUpyo-7EOqi18wCxe6axS2G3y3y222edwBwQxa&__csr=&__req=2c&__beoa=0&__pc=PHASED%3ADEFAULT&dpr=1&__ccg=EXCELLENT&__rev=1002031683&__s=z735kx%3Aaaehpy%3Azjlfzn&__hsi=6818893047177375615-0&__comet_req=0&jazoest=27817&__spin_r=1002031683&__spin_b=trunk&__spin_t=1587643289 "REGULATED\upn3xo@regulated" DIRECT/rupload.facebook.com text/plain DEFAULT_CASE_12-http_Allow_Social_Media-DefaultGroup-DefaultGroup-NONE-NONE-DefaultGroup-NONE <"IW_snet",7.1,1,"-",0,0,0,1,"-",-,-,-,"-",1,-,"-","-",-,-,"IW_snet",-,"Unknown","Social Networking","-","Facebook General","Facebook","-","-",12.43,0,-,"Unknown","-",0,"-",0,0,"d250fc249ffb1d8e81239470faf545c4-0-4893928","854e9c0727ae961da81ffa666e4630aad5549a83e2b7439c4a9bdaa0888cf53b",4,-,"-",-> - - "23/Apr/2020:14:08:21 +0100" 157.240.195.17 443 "Social Networking" 7.1 "https://www.facebook.com/" 52701 "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.80 Safari/537.36" "Social Networking"

2nd log entry blocked for the reason BLOCK_WEBCAT_IDS http 403 response

1587718905.926 4790 9.9.9.9 TCP_DENIED_SSL/403 0 POST https://rupload.facebook.com:443/fb_video/992bb35013d478439471b56938323c4b-0-6698642?__user=758458578&__a=1&__dyn=7AgNe-4amaUmgDxyHqzGomzFEbEyGgmAyAAjFCxG4U9ES2N6xCaxubwTwyCw_DyUJoK6UnGi4EOuUG4Xze3KawCx138S2Sih6UXU98pz8Gicx2q5o4Om5bzEG6Ehwj8lg8VElwgazUtCxy1wDBg5u68bopKEtxy5Urx244WwgFobUKaxi0yogUkGE-V8jK3C4otQeDxaqawG-Ury9m4-9xC5o-cBKm4U9898GfxnwOgG5WwOzV4im4eeKi8wGxm4UGWzU4uUyuES48y2i3yeCzEmgK7pUoz8ixOby8ix22m1fxWEb8oxmE9EjwtUym2mfxW68lBwkUjxy222G3y3y22362m3i&__csr=&__req=4j&__beoa=0&__pc=PHASED%3ADEFAULT&dpr=1&__ccg=EXCELLENT&__rev=1002036047&__s=eu4j7a%3A0klwfp%3A7u0a7t&__hsi=6819200279633322615-0&__comet_req=0&fb_dtsg=AQEWmMw8W_on%3AAQGY-8X6Un5F&jazoest=21991&__spin_r=1002036047&__spin_b=trunk&__spin_t=1587718790 "REGULATED\upn3xo@regulated" NONE/- - BLOCK_WEBCAT_IDS_9-DefaultGroup-DefaultGroup-DefaultGroup-DefaultGroup-NONE-NONE-NONE <"IW_snet",7.1,1,"-",-,-,-,1,"-",-,-,-,"-",1,-,"-","-",1,-,"IW_snet",-,"-","Social Networking","-","Unknown","Unknown","-","-",0.00,0,-,"-","-",-,"-",-,-,"-","-",-,-,"-",-> - - "24/Apr/2020:10:01:45 +0100" - 443 "Social Networking" 7.1 "https://www.facebook.com/" 52615 "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.80 Safari/537.36" "Social Networking"

Re: WSA S695 running IOS 11.8 - posting a video to facebook via https://rupload.facebook.com

balaji.bandi — Fri, 24 Apr 2020 22:05:29 GMT

couple of questions

1. Is the same user having same issue on your both the cases ?

2. your timing of the session does not match - both are different date.

3. not sure how your policy are lined up.

DEFAULT_CASE_12-http_Allow_Social_Media-DefaultGroup vs BLOCK_WEBCAT_IDS_9

example docunent for referene (it was for block same way you can allow)

https://www.cisco.com/c/dam/en/us/td/docs/security/wsa/AVC/Controlling_Facebook_Activity.pdf

Re: WSA S695 running IOS 11.8 - posting a video to facebook via https://rupload.facebook.com

mac987 — Sun, 26 Apr 2020 09:57:21 GMT

thank you for your reply, i have read that pdf and unfortunately it doesnt help but really appreciated

in answer to your questions

1.) It is the all users who have this issue, it doesnt work for any user

2.) These were just examples off the log but the issue is the same all the time

the users can access https://rupload.facebook.com via the allow_social_media access policy but when they try a POST to the same site it ignores this access policy and gets blocked by the default policy

All help is appreciated

kind regards

Graham

Re: WSA S695 running IOS 11.8 - posting a video to facebook via https://rupload.facebook.com

balaji.bandi — Sun, 26 Apr 2020 11:20:15 GMT

To understand better.

can you post the sample Log which have continuty for one user while access from start to deny, so we get better understanding.

is this Video viewing or uploading ? (just to clarify).

Re: WSA S695 running IOS 11.8 - posting a video to facebook via https://rupload.facebook.com

mac987 — Mon, 27 Apr 2020 10:29:49 GMT

The user is trying to post a video, log entries from this morning below

thanks for looking

kind regards

Graham

1587983062.575 744 9.9.9.9 TCP_MISS_SSL/200 39 CONNECT tunnel://rupload.facebook.com:443/ "REGULATED\upn0sz@regulated" DIRECT/rupload.facebook.com - DECRYPT_AVC_7-https_allow_social_media-DefaultGroup-DefaultGroup-NONE-NONE-DefaultGroup-NONE <"C_Bank",7.1,1,"-",-,-,-,-,"-",-,-,-,"-",-,-,"-","-",-,-,"IW_snet",-,"-","Social Networking","-","Facebook General","Facebook","Encrypted","-",0.42,0,-,"-","-",-,"-",-,-,"-","-",-,-,"-",-> - - "27/Apr/2020:11:24:22 +0100" 157.240.195.17 443 "C_Bank" 7.1 - 53886 "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.80 Safari/537.36" "Social Networking"

1587983082.859 176 9.9.9.9TCP_DENIED_SSL/403 0 POST https://www.facebook.com:443/ajax/bz?__a=1&__beoa=0&__ccg=EXCELLENT&__comet_req=0&__csr=&__dyn=7AgNe-4amaWxd2u6aJGi9FxqeCwAyoyGgmAGniheCGgjCxe2qdwIhEnUzgjGqK5-5FEG5VGwxyUymubyRUC6UlWAxamqnK7GgPxW9xaaCzU-foOi8yU-bBAAhfypfBzoggoz8FecGdCDgO8gaEnBx6HBy8G5p8hz8faxaAUvCypHh43Hg-ezFEmUCU9Q6EWul3opxedzoGqq8yVVEGq4rGmmUS695UCWxyp29t5QWDxKqcnBBK69Vp8KVF8-9z9p8jBx-2S4emeGE-Ve4rUrhokGexTzEymcAUG2erXxKiQhxfyopxny_yFrBxe4UgwAyE-9ySUxoK5E8WBxGh2U-hqBhV-p6Ki8Bxybx2ieAyHGfwhAVQnGmu48y22UsVpGyoWp3rx92UtGiiidgOdAzaz8LCxa48kx1aufwPDx6iF8kxa68lG76u4UgwNGeAy8kyb-6oCfxWcUC5pob89EjxyEtwGwUwUwwwwx22m8wHxa&__hsi=6820330006552715623-0&__pc=PHASED%3ADEFAULT&__req=7z&__rev=1002045164&__s=%3A0cdl4q%3Axse6rg&__spin_b=trunk&__spin_r=1002045164&__spin_t=1587981825&__user=100000676450125&dpr=1&fb_dtsg=AQFcmMUWP7ho%3AAQGAXos503nv&jazoest=22057 "REGULATED\upn0sz@regulated" NONE/- - BLOCK_WEBCAT_IDS_9-DefaultGroup-DefaultGroup-DefaultGroup-DefaultGroup-NONE-NONE-NONE <"IW_snet",7.1,0,"-",0,0,0,1,"-",-,-,-,"-",-,-,"-","-",1,-,"IW_snet",-,"-","Social Networking","-","Facebook General","Facebook","-","-",0.00,0,-,"Unknown","-",-,"-",-,-,"-","-",-,-,"-",-> - - "27/Apr/2020:11:24:42 +0100" - 443 "Social Networking" 7.1 "https://www.facebook.com/company name redacted/publishing_tools/?section=DRAFTS&sort[0]=edited_by_descending" 53840 "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.80 Safari/537.36" "Social Networking"

Re: WSA S695 running IOS 11.8 - posting a video to facebook via https://rupload.facebook.com

balaji.bandi — Mon, 27 Apr 2020 22:23:24 GMT

since we are not sure what is Default of your Policy deny for testing above default rule create a new rule for user to upoad.

example :(this is blocked one can be used for allow)

https://www.cisco.com/c/en/us/support/docs/security/web-security-appliance/118277-technote-wsa-00.html