topic Re: HELP: How to block access to any site except those on a whitelist... in General Topics

HELP: How to block access to any site except those on a whitelist...

LCMember4427 — Mon, 21 May 2018 19:43:22 GMT

Hi,

On a certain Zone I need to block access to anything else but these URLs on a whitelist like this:

edition.cnn.com/health
edition.cnn.com/travel
money.cnn.com/technology/

How can I do that most elegantly (I have a VM-100 with latest PanOS)

Thanks a lot for a quick reply on this, I have tried with URL filtering but to no avail...

Tor

Re: HELP: How to block access to any site except those on a whitelist...

Remo — Mon, 21 May 2018 20:04:56 GMT

Configure and enable TLS decryption*: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/decryption/configure-ssl-forward-proxy
Create a custom URL category with your entries
Create a security policy where you add your custom URL category directly into your rule (in the service tab)
Do not create any other rule except a deny-all rule for that zone

*without TLS decryption you'll be only able to filter for the domainname but not edition.cnn.com/health

Re: HELP: How to block access to any site except those on a whitelist...

LCMember4427 — Mon, 21 May 2018 20:19:35 GMT

Hi,

Thanks for the quick reply.

I have actually tried to create a custom URL category as you suggest using create URL Filtering Profile / Override tab and entered the list of 'white' URL's in the left (Allow List) listbox.

Secondly I added this profile to the Security policy for the Zone in question. However, despite this, it unfortunately still allows traffic from any URL.

What am I missing..?

Re: HELP: How to block access to any site except those on a whitelist...

Remo — Mon, 21 May 2018 20:21:04 GMT

If you use your method: have you set every URL category to block?