topic Re: Custom URL Issue in General Topics

Custom URL Issue

MohamedSharief — Wed, 24 May 2017 16:42:46 GMT

Hi all,

I had an issue where a client created a Custom URL category with multiple of URLs and added it in a Security Rule, all of the URLs specified in that custom category is matching except one URL with wild card such as *.sometechnologies.com.

I'm using the command >test custom-url url <MyURL> to check the match but for only one url wild card is not working and the output of the command will be 'any' instead of the custom url category name 'test'.

The client is running PANOS 7.1.5 so I made my lab with the same setup and tried the same url and it was matching 'test'.

The only difference between my client setup and my setup is I've having the URL filtering license which is not even required in case of custom url category.

Have anyone experienced the same?

Regards,

Sharief

Re: Custom URL Issue

Raido_Rattameister — Wed, 24 May 2017 16:50:40 GMT

If Custom URL is *.sometechnologies.com then you have to be sure that user goes to www.sometechnologies.com or ftp.sometechnologies.com or similar site. Something has to be in the front.

If user tries to go to sometechnologies.com then *.sometechnologies.com does not match.

So you usually put 2 entries into custom category

sometechnologies.com

*.sometechnologies.com

Re: Custom URL Issue

MohamedSharief — Wed, 24 May 2017 17:39:07 GMT

Hi @Raido_Rattameister,

Its a server that always connecting to a23-0-91-101.deploy.static.akamaitechnologies.com where in the Custom URL category i've made it *.akamaitechnologies.com but it still doesn't work. Please note that the exact same url speficied above is working in my lab, it must be something with the client environment.

Is a PANOS upgrade could solve this?

Re: Custom URL Issue

Raido_Rattameister — Wed, 24 May 2017 17:51:03 GMT

Ok in your lab do following test to be sure this website fully matches your category and does not pull anything down from other addresses.

Create Custom URL Category and put *.akamaitechnologies.com into it (you probably have it in place already).

Create top rule that permits traffic from your test pc to internet. Under "Service/URL Category" tab choose your custom URL category and permit this traffic.

Create second rule that blocks all traffic to internet from your test pc.

Can you still go to this site?

Be sure to use other browser or clear cache just in case.

Re: Custom URL Issue

MohamedSharief — Thu, 25 May 2017 05:50:51 GMT

Hi @Raido_Rattameister,

Yes its working. I just wanted to say that by running command >test custom-url url <MYURL> it won't give you result unless you attach the Custom-URL category into the Security Rule. So the security rule was there from the beginning and I just created the deny rule.

If I tried the same with the client the command output will match 'any' not the custom-url I've created.

Regards,

Sharief

Re: Custom URL Issue

MohamedSharief — Sun, 28 May 2017 05:12:34 GMT

Anyone have more ideas here?

Re: Custom URL Issue

Bvance — Fri, 16 Jun 2017 20:29:25 GMT

I have the same issue running PAN OS 7.1.4. Using *.sharefile.com in a custom category but it still categorizes it as online-personal-storage in the URL filter logs, which we block. The actual URI they are visiting is warrenaverett.sharefile.com but then directs to any number of other sub domains like storage-ec2-484.sharefile.com. When I run the test custom-url url <MyURL> command it returns "No custom category matched".

Re: Custom URL Issue

MohamedSharief — Tue, 20 Jun 2017 09:26:39 GMT

If the exception is No custom category matched then you may need to add it to security rule and keep it on top just in case. If that is already done make sure you don't have any duplicated URL in other custom URL category.

Regards,

Sharief

Re: Custom URL Issue

JRDeitrich — Thu, 18 Jul 2019 19:46:03 GMT

Having a similar issue with Custom URL Category for Akamai site and SSL Decrypt. Was trying to test earlier, have multiple sites in the URL Category and added to a rule to exempt my machine from decryption, but the logs show that the traffic is still being decrypted and the installation that is trying to reach out is failing. When I switch to a complete no-decrypt, then the traffic is not decrypted and the installation completes.

Re: Custom URL Issue

Akhil_B — Tue, 15 Feb 2022 00:39:10 GMT

I'm having the same issue, Do we have the resolution yet for this? @MohamedSharief

Re: Custom URL Issue

Kevin9722 — Tue, 15 Feb 2022 05:20:26 GMT

@MohamedSharief wrote:
Hi all,

I had an issue where a client created a Custom URL category with multiple of URLs and added it in a Security Rule, all of the URLs specified in that custom category is matching except one URL with wild card such as *.sometechnologies.com.

I'm using the command >test custom-url url <MyURL> to check the match but for only one url wild card is not working and the output of the command will be 'any' instead of the custom url category name 'test'.

The client is running PANOS 7.1.5 so I made my lab with the same setup and tried the same url and it was matching 'test'.

The only difference between my client setup and my setup is I've having the URL filtering license which is not even required in case of custom url category.

Have anyone experienced the same?

Regards,
Sharief

Create Custom URL Category and put *.akamaitechnologies.com into it (you probably have it in place already).

Create top rule that permits traffic from your test pc to internet. Under "Service/URL Category" tab choose your custom URL category and permit this traffic.

Re: Custom URL Issue

O.Pavlyk — Tue, 06 May 2025 11:38:13 GMT

It dosen`t work!!!!!!

Re: Custom URL Issue

JRDeitrich — Tue, 06 May 2025 11:49:18 GMT

I had a realization regarding the Akamai Technologies not working with the Custom URL category a while ago. While the firewall is showing the DNS resolution to a *.akamaitechnologies.com site, that it not neccessarily the URL that the resource is identified by. Due to this, the site is not going to match an akamai URL category, because akamai may not actually the URL that the firewall is using or seeing with the filter. We used the Unified and URL logs to identify the actual URL string that was needed for the custom category when the DNS name is showing a CDN.

Hope this helps someone.

Re: Custom URL Issue

Brandon_Wertz — Tue, 06 May 2025 13:18:51 GMT

@O.Pavlyk wrote:

It dosen`t work!!!!!!

Saying "it doesn't work" to a 3 year old post, and a 5 thread doesn't really help solve your problem, or the OPs. If you're having an issue and were looking for some help if you shared some details maybe we can help determine how to resolve your issue?