URL - Category over-ride not taking effect?
Is your URL category over-ride not taking effect? In firewall rules by domain you do not need to specify the subdomains. Unlike firewall rules (where subdomains covered if you specify a Top Level Domain e.g. "uk" would cover all the subdomains such as bbc.co.uk), category over-ride from CMA for an FQDNs applies just to the FQDN. Any subdomains must be specified with its own FQDN. E.g. over-riding category for http://catonetworks.com to a category of your choice does not change the category for http://www.catonetworks.com Hope you find this helpful.Enhanced Block / Warning Message - Event Reference ID
Last week a very powerful troubleshooting and event monitoring feature "Event Reference ID" was introduced. It will make troubleshooting easier for the admins. Now you can customize the block and warning page to display an external event ID that a user will see in the browser. You can use this to further co-relate the event in the CMA using the Event Reference ID https://support.catonetworks.com/hc/en-us/articles/4413280530449-Customizing-the-Warning-Block-Page#heading-3 How to enable this feature? Enable this for Warning and Block page separately. CMA > Administration > Branding > Warning / Block Page How to co-relate using Event Reference ID? -From CMA > Event Monitoring you can use this reference ID to pivot directly to the eventBlocking TLD (Top Level Domain) or a Specific Country
Use Case 1- How do I block traffic to all *.info websites using TLD? Use Case 2- How do I block traffic to and form a country? > IPS > Geo Cato has a very powerful IPS feature to block both inbound and outbound traffic to a specific country which some of our competitors can't do. They usually will only block outbound traffic to a country based on their ( obsolete) web proxy feature. Cato can do both directions! True power of UZTNA vs the rudimentary ZTNA solutions out there. How? - CMA > Security > IPS > Geo Internet rule > category country > Congo Internet rule > Category > domain > “cg”. Use case 1: Cato makes blocking top level domain as easy as creating an Internet rule with category domain and specifying e.g. "info" as the domain (Yes even the TLD). Subdomains are blocked without specifying the wildcard character automatically. Use case 2: Now you would think if I create an Internet rule with "cg" it will block all traffic to Congo? Yes that works too. Some of our competitors today can't block TLDs (to level domains). This method though only prevents outbound traffic to that TLD (destination country). Going one level further if your use case is to block all traffic to a country, you don't just want to rely on a SWG (RIP the Secure Web Gateway) rule like above. Cato has a very powerful Geo-ip feature that works at the firewall rule level for both inbound and outbound (see the screenshot on the top)! In summary here are 3 ways to do this- Security > IPS > Geo Restriction > Select the country and the direction. Refer to the top screenshot, we have bi-directional support (Cato Differentiator) Internet rule > category country > Congo (SWG / Proxy) Internet rule > Category > domain > “cg”. (TLD - Cato Differentiator) Supporting articles: https://support.catonetworks.com/hc/en-us/articles/360012276478-Configuring-IPS-and-Geo-Restriction Note: Most companies follow their corporate policies or some regulations / embargo in effect to maintain a list of countries to block Make sure you have no users / partners / businesses in the destination country before you put a blanket block While this is as full-proof as it can get there is a gotcha: what happens if the site is using an Anycast service or a CDN service hosted outside the country?
