How to check why application block is blocking some URL in Cisco Umbrella

[CSCO11227946]

Hi all,

I ran in to some issue with Cisco Umbrella Application Blocking, and need help.

Last week i was in process of App Discovery review and allowing/blocking applications.

Users complained that they can't access URL gov.uk and upon running policy tester it shows access is permitted. But only after I added gov.uk to Global allow list access started working again.

Upon further troubleshooting and checking activities i saw that the site was blocked for some period of time. Here is a screenshot:

My question is how to check what exact rule blocked this access?

[Jay Ponce]

You are able to check the Identity and match it with the policies, but it does not give you an exact rule block.

[dcrainey]

How then do you determine which policy to allow a bypass for?  I have the same problem as above.

The specifics - we have users that need to go to the a site that is being blocked. This  site is blocked by Application Block, Software/Technology, Saas and B2B with the specific application Firmex listed and the Application Category listed as Legal.

Destination

ponderco.firmex.com

Categories

Application Block, Software/Technology, SaaS and B2B

Dispute Categorization

Application
Firmex

Application Category
Legal

I have allowed Firmex under the Legal category in our Application Exemption policy but it is still blocked. The exemption policy works for other sites though.

How can I see/discover what else might be blocking this site in order to grant access?

[dcrainey]

We have discovered that in our case this was related to an authentication issue with the user and umbrella when the user was accessing the corporate network via VPN and then attempting to access the website. 

[dcrainey]

In our case it ended up being an issue with authentication to Umbrella when accessing the corporate network via VPN. Resolving that resolved the issue.