topic Re: Unable to Add URL-Based External Dynamic List as Destination in Policy-Based Forwarding Rule on Panorama in Panorama Discussions

Unable to Add URL-Based External Dynamic List as Destination in Policy-Based Forwarding Rule on Panorama

Stellar — Fri, 21 Apr 2023 22:41:22 GMT

I am attempting to use an External Dynamic List (EDL) with a URL-based list as the destination in a Policy-Based Forwarding (PBF) rule on Panorama. However, when I try to add the EDL as the destination in the PBF rule, I am not able to see the URL-based list EDL in the destination list. I have checked that the EDL is configured correctly, assigned to the correct device group. Additionally, I have verified that the license for Threat Prevention includes the URL filtering feature. What could be causing this issue and how can I resolve it?

Re: Unable to Add URL-Based External Dynamic List as Destination in Policy-Based Forwarding Rule on Panorama

Raido_Rattameister — Fri, 21 Apr 2023 23:16:38 GMT

You can't route traffic based on URL.

Web traffic is running over TCP.

In case of TCP URL is in 4th packet (in best case if it is http) or later (if it is https).

SYN

SYN-ACK

ACK

HTTP GET <<< URL is here

Routing decision needs to be done on first packet.

So you can't use URL to make routing decisions.

Re: Unable to Add URL-Based External Dynamic List as Destination in Policy-Based Forwarding Rule on Panorama

Stellar — Sat, 22 Apr 2023 00:39:14 GMT

I have tested a PBF rule using an FQDN as a destination and it works fine. The firewall resolves the IP addresses associated with that FQDN, and then makes the routing decision based on those IP addresses. Does the firewall use different methods to handle URL-based EDLs?

Re: Unable to Add URL-Based External Dynamic List as Destination in Policy-Based Forwarding Rule on Panorama

Raido_Rattameister — Sat, 22 Apr 2023 00:52:42 GMT

If you use FQDN based list then domain is resolved to IP and traffic is routed based on this destination IP (first packet).

If you se URL based list then firewall does not intercept TCP 3way handshake and takes action when it sees website URL passing by in either HTTP GET packet (if clear text) or from certificate (when ssl).