topic Re: How to specify specific users / groups in URL Filtering Policies in General Topics

How to specify specific users / groups in URL Filtering Policies

alexdelangel — Wed, 06 Sep 2017 22:25:19 GMT

Hey guys!

We got a couple of 7050s in our Data Center with URL Filtering license, and we are planning to implement the URL Filtering feature.

I understand first thing is to create the URL profile with the allowed / denied categories and attach it to the Security Policies that allow outbound Internet access.

But my concern is how to enable the use of specific users or groups to those security policies?

I have enabled User-ID agent in my environment, the User-ID agent is retrieving the user to IP address mappings from the Domain Controllers, and my Firewall is already talking to the User-ID agent!

However, could anyone let me know if I still need to add some LDAP configuration to my Firewall? Or if I'm ready to implement Web Filtering to specific users.

Kind Regards!

Re: How to specify specific users / groups in URL Filtering Policies

jvalentine — Wed, 06 Sep 2017 22:52:47 GMT

I would configure LDAP so that the firewall can pull in groups of users.

At the top of your security policy, create a couple of group-based overrides. Assuming you generally block adult + gambling sites, create two groups in your LDAP server, "URL-adult" and "URL-gambling".

Next, create a single URL filtering profile called "override alert URL", with action=alert for all categories. Attach that profile to these override rules.

Then you can create security policies that look like this:

from trust to untrust, user=URL-adult, application=web-browsing+SSL, URL category=adult, action=allow

from trust to untrust, user=URL-gambling, application=web-browsing+SSL, URL category=gambling, action=allow

lather, rinse, repeat for the URL categories where you need to provide an override and commit your changes.

The nice thing about this is that you only need to add a user to the LDAP group in order to permit them access to an overridden category. (The firewall refreshes LDAP groups every 60 minutes, so you may need to wait that long for it to work - or perform a manual refresh via the CLI).

If you want to warn your user that they're visiting a normally-blocked website because they have override privileges, modify your URL filtering profile from "override alert all URL" with action=alert, and change all of the actions=continue. This way, if someone is visiting an overriden webpage, they're shown the block/continue page with a customizable warning and must click "continue" in order to visit the overriden webpage.

Re: How to specify specific users / groups in URL Filtering Policies

alexdelangel — Thu, 07 Sep 2017 01:46:40 GMT

Hi Valentine,

Thank you so much for your answer, that's exactly what I need. I need my firewall to be able to pull in groups of users.

I was with the idea that user-ID agent would give me the capability to define groups of users to my Security Policies, but I see that additionally I need to configure LDAP.

I found the below documentation, could you let me know if that should be enough?

https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/authentication/configure-ldap-authentication

Thank you!

Re: How to specify specific users / groups in URL Filtering Policies

jvalentine — Thu, 07 Sep 2017 15:01:58 GMT

I would start here:

- https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/user-id/map-users-to-groups#_74222

You don't need to do LDAP authentication based on your original question. Your main goal is to get the firewall to download a list of LDAP groups and the names of the users in each of the groups.

With this in place, you can create security policy based on username and/or LDAP group.

Re: How to specify specific users / groups in URL Filtering Policies

Wald — Thu, 07 Sep 2017 15:58:25 GMT

Those 7000 series firewalls can handle up to 10,000 LDAP groups so you should be good to go!

Re: How to specify specific users / groups in URL Filtering Policies

alexdelangel — Thu, 07 Sep 2017 17:23:37 GMT

Hey Valentine!

Thank you so much for the provided assistance, and documentation. I confirm now I'm able to create Security Policies based on username, and LDAP groups.

Kind Regards!

Re: How to specify specific users / groups in URL Filtering Policies

Mass — Fri, 08 Sep 2017 04:48:50 GMT

@Wald wrote:
Those 7000 series firewalls can handle up to 10,000 LDAP groups so you should be good to go!

Is it correct if we assume the maximum number of groups we can add per virtual system (Group Include List and Custom Group tab combind) will still be 640 groups?