Symptoms: Few sites like Youtube.com do not load completely when added in explicit allow and deny all DFW configuration.
Environment
VMware NSX-T Data Center 3.x VMware NSX-T Data Center VMware NSX-T
Cause
Specific websites where there is a dependency on multiple domains for the page to load fully face issues when used in URI DFW as explicit allow. Below is an example : Youtube.com : dependency on multiple domains (*youtube.com || *.googleapis.com || *.googlevideo.com || *ytimg.com etc)
DFW config allowing ONLY youtube.com 0: any any allow DNS 1: any any allow www.youtube.com 2: any any block
Resolution
Create an explicit allow DFW FQDN based rule for website with multiple dependencies
Workaround: Use the Network option in developer tool to gather details of the domain where there is dependency and allow them in the DFW policy.
Additional Information
NSX is working as expected to allow youtube.com and block the rest of the domains. Hence in order to load the website fully, all the dependent domains are also required to be allowed in DFW configuration before the "deny all" rule.
Impact/Risks: Specific websites don’t load completely