topic Source Based Custom URL Lists in General Topics

Source Based Custom URL Lists

mlinsemier — Tue, 20 Dec 2016 20:18:02 GMT

All,

Does anyone know a way to setup source-based Custom URL Lists containing domains as an alternative to using source-based IP addresses and address groups? I don't think it's possible in any of the current versions of PAN-OS but i am looking at options.

For example, if i want to limit inbound SMTP to our edge Exchange server from the Microsoft Exchange Online cloud, I have to add 24 IP addresses that resolve to *.outbound.protection.outlook.com. It would be a way better solution to just allow IP's that all resolve to a *.outbound.protection.outlook.com contained in a Custom URL.

Am I just missing something here? Is there a better way to do this?

-Matt

Re: Source Based Custom URL Lists

Raido_Rattameister — Wed, 21 Dec 2016 04:33:11 GMT

URL categories can be used for web-browsing traffic not SMTP.

For other traffic you can use IP's or address objects. Address object can be FQDN so name.

https://live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-and-Test-FQDN-Objects/ta-p/61903

Most likely this will not resolve your wish to match *. addresses.

Palo Alto has tool MimeMeld ( https://live.paloaltonetworks.com/t5/MineMeld/ct-p/MineMeld ) that can pull info from diferent sources (for example MS IP list https://support.content.office.net/en-us/static/O365IPAddresses.xml ) and Palo can pull this info from MimeMeld and you can use this data in source ip address field of your policy.

Re: Source Based Custom URL Lists

mlinsemier — Wed, 21 Dec 2016 18:03:11 GMT

This offers some clarity to URL categories as I was always curious on web-browsing/ssl traffic or say a protocol like SMTP using TLS1 (ssl). This actually make much more sense now going forward.

You are right by saying using FQDN will not work as I cannot use *.domain.com in it which is what really i want to be able to do. Ulitimately i ended up adding the 24 host subnets which resolves the issue, but being able to do wildcard source domains would be way cleaner as unless the domain and subdomains change completely, you would never have to update a IP list again.

I will take a look at the MineMeld tool as well. I wanted to look at this in the past, I just ran out of cycles to do so.

Thanks for this!

Matt

Re: Source Based Custom URL Lists

Raido_Rattameister — Wed, 21 Dec 2016 18:41:31 GMT

Few more bits.

URL category is compared to HTTP GET request field.

If you don't decrypt SSL/TLS then this flies by in encrypted payload and Palo can only read data on certificate and compare this to URL category.

FQDN resolves name to IP's (like if you run nslookup www.microsoft.com from command prompt) and it is impossible to resolve *.microsoft.com against dns server.