> Source: [sk175444](https://support.checkpoint.com/results/sk/sk175444)

# sk175444 - URL Filtering Categorization  issue

| Property | Value |
|----------|-------|
| Solution ID | sk175444 |
| Date Created | 2021-09-16 |
| Last Modified | 2021-10-20 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.10 (EOS), R81 (EOS) |

## Symptoms

- * A URL Filtering (URLF) rule is configured to block a Google website or a website that uses a Google certificate (examples: `google.com` - `gmail.com` - `youtube.com`). Users can access the blocked website.
* The blocked website appears in the categories "Search Engines / Portals" and "URL Filtering" but is still accepted in the rule with category "Computers / Internet".
* The behavior does not change when HTTPS Inspection is enabled, or when APPI (Application Control Inspection)/URLF settings are in a Background/Hold configuration.
* When URL Filtering is disabled, traffic to the Google website is blocked and is no longer accepted in the category "Computers / Internet".
* This is the output of the kernel debug of APPI:

  ```
  [cpu_3];[fw4_0];1:[SID: 00000] {???????global}??????? appi_rad_uf_cmi_handler_fill_application: IDS --properties_string Search Engines / Portals,URL Filtering-risk 0--;
  [cpu_3];[fw4_0];1:[SID: 00000] {???????global}??????? appi_rad_uf_cmi_handler_fill_application: IDS --is_valid-1-app_name google.es categories_string Search Engines / Portals--;
  ```

## Cause

This is expected behavior. The same Google website can be included in more than one category. URLF and APPI can use different categories. For example, URLF classifies the website as "Search Engines" and APPI classifies the website as "Google Services".   

<br />

In APPI, the category of "Google Services" is classified as "Computers/Internet", so there is a match with the allow list rule in the "Computers/Internet" category.  

Example:

```
[cpu_3];[fw4_0];1:[SID: 00000] {policy} appi_cmi_handler_handle_pm_match: app found. app_sig_id = 60340676:10;
[cpu_3];[fw4_0];1:[SID: 00000] {global} appi_app_db_get_app_name: �app_name "Google Services";
//URLF find the category
[cpu_3];[fw4_0];1:[SID: 00000] {global} appi_rad_uf_cmi_handler_fill_application: IDS --properties_string Search Engines / Portals,URL Filtering-risk 0--;
[cpu_3];[fw4_0];1:[SID: 00000] {global} appi_rad_uf_cmi_handler_fill_application: IDS --is_valid-1-app_name google.com categories_string Search Engines / Portals--

```

In the RB that is running, there is a match on the Google Services application in the Computers/Internet category.  

Example:

```


[cpu_3];[fw4_0];up_column_application_do_clobs_match: received application id 60340676;
[cpu_3];[fw4_0];up_column_application_do_clobs_match: clob matched on compound_list_size: 0;
[cpu_3];[fw4_0];up_column_application_do_clobs_match: matching cat id 42000001;
[cpu_3];[fw4_0];up_column_application_do_clobs_match: matching cat id 1;
�
From appi_db.C:
� � � � � � � � � � � � � � � � � � � � � � � � :id (42000001)
� � � � � � � � � � � � � � � � � � � � � � � � :name ("Computers / Internet")
� � � � � � � � � � � � � � � � � � � � � � � � :risk (0)
� � � � � � � � � � � � � � � � � � � � � � � � :priority (500)

```

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content