topic Re: Transparent URL Filtering Only - Not Firewall in General Topics

Transparent URL Filtering Only - Not Firewall

mjensen323 — Tue, 21 Jul 2015 14:25:47 GMT

Are there any instructions or can someone shed some light on doing only URL filtering on the PA and not using it as a firewall yet.

Re: Transparent URL Filtering Only - Not Firewall

pulukas — Tue, 21 Jul 2015 22:04:51 GMT

Are you setting this up with an existing firewall and inserting this in the path for URL filtering?

If so, you can use the v-wire instance that exists by default on most models. This will insert on the trust side of your existing firewall to read all the outbound traffic.

Create two rules:

untrust to trust with allow all

trust to untrust with allow all and add your url filtering profile to this rule

I would also add a basic threat profile so you can get logging on this as well.

Re: Transparent URL Filtering Only - Not Firewall

mjensen323 — Wed, 22 Jul 2015 15:57:25 GMT

Thanks for the reply.

Does that mean the flow is this:

ASA Firewall -> Palo Alto -> Existing Network or does the vwire see traffic on a span and block it accordingly?

Thanks again.

Re: Transparent URL Filtering Only - Not Firewall

pulukas — Wed, 22 Jul 2015 21:55:26 GMT

In order to block traffic you would need to be in-line as you indicate.

Palo Alto can be setup using a span port and the PA interface as a Tap. But you can only report on traffic then you cannot block anything as you are only seeing a copy of the traffic not the actual flow.