topic URL exeptions best practis in General Topics

URL exeptions best practis

YGoldy — Sat, 31 Aug 2024 11:46:08 GMT

Hi All.
I'm new in Palo Alto.
My goal is to exclude some IPs (Mainly some Broadcast TV channels) from scaning and intrusion ditection, for improving throughput.

Now there are some ways to achive this, but i wondwer what is the best way?

Regards'

Goldy

Re: URL exeptions best practis

TomYoung — Sat, 31 Aug 2024 17:06:40 GMT

Hi @YGoldy ,

Great question. I believe the best way is to create a new security policy rule with those destination IP addresses or URLs and attach either (1) no security profile or (2) a modified security profile to the rule. You would definitely want to define the applications and services to strictly control the traffic allows.

Thanks,

Tom

Re: URL exeptions best practis

YGoldy — Sat, 31 Aug 2024 17:54:03 GMT

Hi Tom.
Thanks For your respond.

This is decently one of the possibilities I was thinking about.
Another possibility I was thinking about, is to create URL Category with all those URLs and IPs, then create URL Profile which allow this category (together with other allowed and blocked category, and apply it to a policy.

The thing is what come first and what is more efficient and take less recourses.

regards,

Goldy.

Re: URL exeptions best practis

TomYoung — Sun, 01 Sep 2024 03:04:05 GMT

Hi @YGoldy ,

You mentioned that you also wanted to exclude intrusion detection. This may include Vulnerability, Antivirus, and other profiles and cannot be done entirely with a URL Filtering profile.

You could put a custom URL category as a destination in a security policy rule. I didn't think that IP addresses could be put in a custom URL category, but this doc says you can. https://docs.paloaltonetworks.com/advanced-url-filtering/administration/configuring-url-filtering/url-category-exceptions

A custom URL category would make the security policy rule cleaner without the long list of URLs or IP addresses.

If this list will change frequently, you can use an EDL that you edit on a web server off the NGFW and do not have to commit with each change. The NGFW can be configured to check the EDL every 5 minutes. The doc above says a URL List type EDL can contain IP addresses and domains. I did not know that either.

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/configure-the-firewall-to-access-an-external-dynamic-list

Thanks,

Tom

Re: URL exeptions best practis

YGoldy — Sun, 01 Sep 2024 08:53:21 GMT

Very nice 😊

Can you add EDL to URL Category?

Thanks,
Goldy

Re: URL exeptions best practis

TomYoung — Sun, 01 Sep 2024 12:07:41 GMT

Hi @YGoldy ,

No. Check out the links I posted.

Thanks,

Tom

Re: URL exeptions best practis

YGoldy — Sun, 01 Sep 2024 12:22:19 GMT

Thanks 🙏