How to block a Specific `https` Site(internal DMZ) with URL Filtering

JoDW78 — Tue, 30 May 2017 01:27:09 GMT

Im new Paloalto FW and welcome any advice.

I`ve applied url block a Specific web site(internal DMZ serverfarm) From Untrust access /w Paloalto pa3020/os 6. Exist system was `https ssl` decrypted. So, when I get into the site with `http`Its blocked with FireWall But when I get into the site with `https' Its not blocked. My question is How can I block `https` url with Pa3020/ os6? thx for reply!

Re: How to block a Specific `https` Site(internal DMZ) with URL Filtering

Raido_Rattameister — Tue, 30 May 2017 02:06:10 GMT

Welcome to community.

If you want to decrypt traffic from Untrust towards server under your control then you have to export certificate together with private key out from web server and import it into firewall.

If you click on mag glass is Decrypted yes or no on those sessions?

If you don't decrypt then Palo will identify site based on website address on certificate as HTTP GET goes through firewall encrypted.

https://www.paloaltonetworks.com/documentation/60/pan-os/pan-os/decryption/configure-ssl-inbound-inspection

topic How to block a Specific `https` Site(internal DMZ) with URL Filtering in General Topics

How to block a Specific `https` Site(internal DMZ) with URL Filtering

Re: How to block a Specific `https` Site(internal DMZ) with URL Filtering