search cancel

Blocked Categories in G4 override all allow rules above the list


Article ID: 168307


Updated On:


Web Security Service - WSS


Web Security Service (ThreatPulse)

There is a scenario where Block Categories in the G4 policy row overrides all Allow rules above the list. This occurs only when the SSL Interception is set as Disable and the site is HTTPS; HTTP sites are not blocked.


The ThreatPulse policy is not able to determine category by its URL because with HTTPS/SSL the URL is known only after the SSL handshake.


For security reasons, this is the expected behavior.


Possible workarounds.

Enable SSL Interception.
Services > Network > SSL > Enable
Note: Clients must install the Entrust Root certificate to be trusted and avoid the warning prompt.

Remove the category from the G4/Block Categories rule and create another rule specifically to block this categories below the Allow rule for specific clients or destinations.
Note: This additional rule is different from G4 because G4 defaults to Anyone and Anywhere.