topic URL Filter Security Policy Structure in General Topics

URL Filter Security Policy Structure

Josh_Morris — Thu, 20 Jan 2022 18:54:44 GMT

Hello all. New to PAN, and after reviewing the documentation on URL Filtering, I'm confused on the best practice deployment of the policy structure. Here's what I mean:

Let's say I want to break out the policies into multiple granular policies for custom exceptions. It would look something like this:

1) URL Filter Policy: "Vendor Safelist"

Custom URL Category "Vendor List": Allow
Everything else (pre-defined):???

2) URL Filer Policy "MISC Web"

Pre-Defined categories: Alert some
Pre-Defined categories: Block some

The way I'm understanding this is that if I access a vendor site, Profile #1 will match and allow it, but I don't want everything else to either block/allow/alert. I want the traffic for non-vendor URLs to progress down to the next policy so it can be processed by #2.

The reason for this is to A) have some logical organization of the policies, and B) not have one massive policy to manage everything. What I'm asking today is that it seems like this structure isn't viable, and that only one massive policy can work. Am I missing something?

Re: URL Filter Security Policy Structure

Raido_Rattameister — Fri, 21 Jan 2022 04:21:06 GMT

URL filtering kicks in after traffic has already matched to the security policy.

You could test adding FQDN type address objects for "Vendor List" domains and place those FQDNs into "Vendor Safelist" policy destination address field.

In this case firewall will resolve those addresses to IP and "Vendor Safelist" policy will only match if traffic goes to IPs that host "Vendor List" websites.

Re: URL Filter Security Policy Structure

JGriessmeier — Fri, 21 Jan 2022 09:32:13 GMT

Hi Josh,

in your security policies you can add the url category as matching criteria under "Service / URL Category"

so you can build 2 security policies

the first with your custom URL "Vendor List"

and the second one without the URL Category match.

On both you can apply the URL Filtering Profile that is needed.

Greetings