Technical Tip: How to enable access only to internal domains hosted on Google while the web filter category 'Web-based Email' is set to block

4. Go to the CLI and the following entries and verify if they look like the following:

 

config webfilter urlfilter .

show

    edit 1

 

config webfilter urlfilter

    edit 1

        set name "Auto-webfilter-urlfilter_gkkqnfrif"

            config entries

            delete 1                                <----- This will delete the 'example.com' entry created from GUI.

                edit 1

                    set url "*.google.com"

                    set type wildcard

                    set web-proxy-profile "Auto-web-proxy-profile_ff0ygfu3d"

                next

                edit 2

                    set url "gmail.com"

                next

                edit 3

                    set url "google.com"

                next

            end

    next

end

 

 

To allow uploading and downloading files from Gmail without any restrictions, conditioned to the 'Web-based Email' category being blocked, add the URLs in charge of this process in the webfilter urlfilter. In this case, the one known so far is 'mail-attachment.googleusercontent.com', which also belongs to the blocked category.

This URL must be allowed or exempted to allow uploading and downloading files from the email:

    config webfilter urlfilter
        edit 2
            set name "Auto-webfilter-urlfilter_2ge7ltkpd"
                config entries
                    edit 1
                        set url "*mail-attachment.googleusercontent.com*" <---
                        set type wildcard
                    next
                end

    next
end

 

Additional Requirement:

For the configuration to work as expected, it is necessary to block the QUIC protocol (HTTP/3 over UDP/443). If QUIC is not blocked, Gmail traffic may bypass proxy-based inspection and web filter policies, allowing access to personal accounts despite restrictions. This can be achieved by creating or editing an Application Control profile and setting the QUIC protocol action to Block, then applying this profile to the same firewall policy where the Web Filter is enforced.

 

Ensure that the firewall policy using the web filter profile is configured in proxy mode, as domain-based Google account restrictions do not function in flow-based mode.

 

For other options to block QUIC, see this article: Technical Tip: How to block/disable QUIC.

 

Delete all Exemptions added on the Deep Inspection SSL profile. Preferably, clone the Deep Inspection profile and customize it, deleting all Exemptions (objects) on that SSL/SSH profile.

 

Identify the URL that allows the upload and download of files and configure it in the URL filter in case there are any more through webfilter profile logs.

 

• Access to any email service will be denied (according to the webmail Category).
• Access to personal Gmail Accounts on any other domain hosted on Gmail will be denied.
• Access only from addresses containing @Company.com will be allowed. 
  
• Access only from addresses containing @Company.com will be allowed. 
• Access to File uploads and downloads will be allowed from the @Company.com domain even if the 'Web-based Email' category is being blocked.