topic Re: URL Category and IP address blocks in Next-Generation Firewall Discussions

URL Category and IP address blocks

NGJ1 — Mon, 22 Jan 2024 17:06:16 GMT

I have inherited a system with a Custom URL Category that includes URLs and IPs, this is attached to a URL filtering profile that is set to block within a Security Profile Group.

Can IP addresses really be added to a Custom URL Category, or are they simply for URL inspection.?

If so, does the firewall therefore only block the traffic if the IP is part of the URL?

Also, I know within Cisco Security Intelligence an FTD has a network policy list to drop early traffic, if an IP exists here, any traffic matching the IP is dropped before it gets to the ACL for further filtering. Is there an equivalent within Palo Alto to list IPs that any matching traffic is dropped before any Security rule is processed.

Thanks

Re: URL Category and IP address blocks

OtakarKlier — Mon, 22 Jan 2024 20:37:11 GMT

Hello,

Not IP's to the URL categories. Could be a separate security policy with the IP's as source or destination. But sounds like you want to block an internal server from internal users? I tend not to do URL filtering inside my network since it can cause issues, etc. What I use is user-id mapping so only users that should have access can even see the site.

Regards,

Re: URL Category and IP address blocks

NGJ1 — Tue, 23 Jan 2024 12:53:41 GMT

Hi. It is an external access rule for users to access the internet. In addition to the URL filter Categories, we have another Custom URL list applied to the filtering policy to block URLs

My concern was are IPs meant to be added to a Custom URL Category, is that normal practice.

Thanks

Re: URL Category and IP address blocks

OtakarKlier — Tue, 23 Jan 2024 15:52:50 GMT

Hello,

For external access, I dont play IP whack-a-mole. Meaning IP's change too frequently so I go with the dynamic approaches. I use External Dynamic Lists that are built-in to block/allow certain groups etc.

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/external-dynamic-list

Cheers!

Re: URL Category and IP address blocks

NGJ1 — Thu, 25 Jan 2024 13:18:12 GMT

Hi, good point, the EDL is the approach I will use going forward for these IP blocks.

Thanks