topic Re: Allow traffic to specific URL - Best practices in General Topics

Allow traffic to specific URL - Best practices

FabioGarcia — Wed, 26 Dec 2012 17:56:26 GMT

Dears,

I have 2 PA2020 implemented working as webfilter only. (virtual wire feature)

I need to implement a rule which will permit any user to access the website www.adpweb.com.br anytime...

What I did:

Rule at first position

source: any user, any zone,

destination: any IP, any zone

URL: I created a specific URL Category

I see that many others traffics are passing using this rule....

Question:

How is the best practice to implement this rule?

All users here, doesnt matter the profile or department should be able to access this website...

After this rule all other rules are already implemented to filter/permit traffic

Logs showing many kinds of traffic parring thru this rule:

Thanks in advance!!

Re: Allow traffic to specific URL - Best practices

ExclusiveNetworksGermany — Thu, 27 Dec 2012 12:59:49 GMT

I don't know why the Traffic hits your first Rule.

Normally i should not match this Rule if the URL Category does not apply.

But you can modify your Rule that the Destination Address FQDN matches to your Server.

Something like this:

For the URL Category there is more debugging necessary.

You can activate the visibility of the URL Category column :

Regards

Marco

Re: Allow traffic to specific URL - Best practices

FabioGarcia — Thu, 27 Dec 2012 13:42:47 GMT

Hey Marco!

That worked very well!!!

Now I see only that IP address passing thru that rule...

Danke schön!!!!

Fabio

Re: Allow traffic to specific URL - Best practices

mikand — Sun, 06 Jan 2013 22:48:42 GMT

I think the problem is that this rule is "appid:any, service:any" which gives that the url category stuff is only valid for web-based appids. Meaning if oracle and other non-web-based flows arrives they wont be checked for the url category.

The proper setup of this rule should be:

appid:web-browsing

service:application-default (or if possible set it manually to TCP80 or whatever proto/port this server uses)

url-category: allow only "www.adpweb.com.br".