topic Re: URL Filtering Log in General Topics

URL Filtering Log

Mark-Nakrop — Mon, 08 Aug 2011 07:54:16 GMT

Hi all,

Are there anyone found URL Filtering log like below:

*.dropbox.com/

*.settrade.com/

*.facebook.com/

What does " * " means?

Re: URL Filtering Log

ukhapre — Mon, 08 Aug 2011 23:19:22 GMT

Hello, Are you seeing this in URL filtering log???? thats not known behaviour.

You would generally put *.facebook.com under object -> security profile- > URL filtering -> block/allow

* means all the subdomains - e.g. chat.facebook.com.

Hope this helps.

Thanks

Unnati

Re: URL Filtering Log

Mark-Nakrop — Wed, 10 Aug 2011 11:37:07 GMT

Hi ukhapre,

I have one more question.

I set URL Filtering to allow only Facebook in allow list, and block category Social Network.

PAN should block all of Social Network, and allow only Facebook in the same time right?

But it still block Facebook.

Please advise.

Re: URL Filtering Log

lardsa — Wed, 10 Aug 2011 11:52:55 GMT

Facebook uses several domains, like fbcdn.com or fbcdn.net

Re: URL Filtering Log

lardsa — Wed, 10 Aug 2011 11:55:05 GMT

about your first question for names like *.facebook.com, it appears when a website is using SSL. Because of encryption, PaloAlto cannot see the real URL that is asked by the client. So it will log certificate name instead.

If you want to see URLs inside a SSL encrypted session, you must configure PA SSL Decryption.

Re: URL Filtering Log

ukhapre — Thu, 11 Aug 2011 03:14:19 GMT

Did you add both sites below?

*.facebook.com

facebook.com

It should work unless its trying to reach sites other than above.

Re: URL Filtering Log

Mark-Nakrop — Thu, 11 Aug 2011 03:22:02 GMT

Hi ukhapre,

I tried on both, and it is not working. But after restart device, it is work.

This is all i tried with regular expression,

*.facebook.com

www.facebook.com

www.facebook.*

*.facebook.*

Re: URL Filtering Log

Laforgepaul — Thu, 11 Aug 2011 18:05:27 GMT

This is what works for us

*.facebook.com

facebook.com/

Hope this helps