topic Re: PBF based on URL Filtering/Application in Next-Generation Firewall Discussions

PBF based on URL Filtering/Application

LeoLion — Tue, 22 Aug 2023 05:03:49 GMT

hi everyone,

We have a PBF Rule allow all internal users to internet via our ISP1.

And I want to create another PBF rule on top of the above PBF rule to allow Instagram application traffic towards ISP2?

I look through the below KB but it is not doable:
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clq1CAC

So i want to check if anyone have other alternative on this? Please advise!

Re: PBF based on URL Filtering/Application

Raido_Rattameister — Tue, 22 Aug 2023 05:12:47 GMT

Routing decision needs to be made based on first packet in session.

As first packet in session is SYN that don't include URL you cannot configure PBF based on URLs.

You could set create FQDN address object for instagram.com (and any other domains related to Instagram) and set PBF by placing those FQDNs into destination IP field.

Re: PBF based on URL Filtering/Application

LeoLion — Tue, 22 Aug 2023 05:17:19 GMT

are we able to create a willcard domain for instagram? Or we really need to create all the domain related to instagram?

Re: PBF based on URL Filtering/Application

Raido_Rattameister — Tue, 22 Aug 2023 05:24:28 GMT

You can't use wildcard as Palo needs to resolve those domains to IP address so taking this route you need to add every domain.

Re: PBF based on URL Filtering/Application

LeoLion — Tue, 22 Aug 2023 05:28:22 GMT

@Raido_Rattameister

Noted on this method.

Do you have other alternative other than this?

Re: PBF based on URL Filtering/Application

ozheng — Wed, 23 Aug 2023 10:00:39 GMT

Hello LeoLion,

If you have SDWAN license on the firewall, you can set up some sdwan rules.

So you can set some rules on app-id.

Olivier