Author: tdewille

The goal here is to set a URL filtering policy that will caution the user about visiting a certain URL. Let’s say that the user wants to go to a gambling website. You don’t want to block it but maybe you feel that it’s best to warn the user that you are monitoring this activity. The user gets the Caution page with a Continue button, clicks on the button and can finally do some good old gambling.

Step 1
Create a URL policy with Action: Caution with Redirect
In my case the URL category ‘gazeta’ contains a popular news portal Gazeta.pl

Step 2
Activate the policy

Step 3
You need a server where you can host the redirect page. In my case it’s my own laptop with XAMPP software where I have the Apache server running, hence 127.0.0.1/indexa.php

Then create a file called indexa.php with the following code and put the file in the xampp’s htdocs folder.

<html>
    <head>
        <title>test</title>
    </head>
    <body>
        
        <?php
            $url         = $_GET['url'] ?? '';
            $referer     = $_GET['referer'] ?? '';
            $reason      = $_GET['reason'] ?? '';
            $reason_code = $_GET['reasoncode'] ?? '';
            $timebound   = $_GET['timebound'] ?? '';
            $action      = $_GET['action'] ?? '';
            $kind        = $_GET['kind'] ?? '';
            $rule        = $_GET['rule'] ?? '';
            $cat         = $_GET['cat'] ?? '';
            $user        = $_GET['user'] ?? '';
            $lang        = $_GET['lang'] ?? '';
            $zsq         = explode("zsq", $_GET['zsq'] ?? '');
        
            
        ?>
        
		<h1>hello from Apache... YOU HAVE BEEN CAUTIONED MY FRIEND!!! </h1>
        
        <?php 
        echo "Portal " . $url . " MAY HAVE BEEN COMPROMISED" 
        ?> 
		
            <pre> 
               __
              / _)
     _.----._/ /
    /         /
 __/ (  | (  |
/__.-'|_|--|_|
 /\_/\  
( o.o ) 
 > ^ <
 
 
  / \__
 (    @\___
 /         O
/   (_____/
/_____/ U
</pre>
     <form id="continue_action" method="GET" action=https://gateway.zscalerone.net:443/_sm_ctn>
        <input type="hidden" name="_sm_url" value="<?php echo htmlspecialchars($url); ?>"/>
        <input type="hidden" name="_sm_rid" value="<?php echo htmlspecialchars($zsq[0] ?? ''); ?>"/>
        <input type="hidden" name="_sm_cat" value="<?php echo htmlspecialchars($cat); ?>"/>
        <input type="submit" value="Continue" id="submitButton"/>
    </form>
    </body>
</html>

The animals are totally optional but the rest is not. Whether you decide to pass on other arguments to Zscaler is up to you but url, rid and cat are mandatory.

Step 4
Go to gazeta.pl and you can see the following instead:

Click on the button and you can see the news portal.

You can change the action to Block with Redirect as well. In that case you don’t need to pass on the arguments to Zscaler because the user will never get to the original URL anyway

One of my clients asked me yesterday how to override DNS responses. This turned out to be quite easy… but only if you know how to do it 😀

Prerequisite:
1) You need to make sure that DNS traffic reaches Zscaler. This means that your DNS server cannot be a private IP address. Set it to e.g. 8.8.8.8.
2) This will not work for explicit proxy forwarding method (e.g. without ZCC). Why? DNS control does not manage this traffic even though Zscaler service edge resolves those requests. Again, we need to see incoming DNS traffic from the client.

Step 1

Create a new URL category with your FQDN. In my case i created the category ‘gazeta‘ which includes the fqdn gazeta.pl

Step 2
Create a DNS control policy with Request Category: <your new category> and Redirect Response field set to <IP address you want to set instead of the normal returned IP>

Here I’m changing the returned IP to 4.3.2.1

Step 3
Activate the change.

Step 4
Verify it’s working as required:

Interestingly enough, I was still able to open the website because in this logic, gazeta.pl is not enough. You need to have http://www.gazeta.pl as well or the logic will not apply.

After I blocked http://www.gazeta.pl, the site won’t open anymore.

What can go wrong here?
Make sure your ipv6 stack is disabled (either via the forwarding profile or manually on your network card).

Now you can use regex patterns to match multiple URLs.

As part of this update, in the Administration > URL Categories > Add URL Category window, the URL Type toggle has been added to select one of the following options:

• Exact: to add the custom URLs, keywords, and IP ranges to a category.
• Regex: to add patterns to a category.

Remember that you need to open a support ticket to get this feature enabled! This feature is still in Limited Availability so expect some questions from the support team before they enable it.

I’ll try and test this as soon as I get this feature enabled on my tenant.

We have added the URL Filtering and Cloud App Control roles!