topic Re: how to whitelist Akamai downloads ? in General Topics

how to whitelist Akamai downloads ?

DaxVC — Tue, 20 Nov 2018 09:41:04 GMT

How do yuo configure a correct FW rule to only allow downloads for a specific user from a specific URL, but the content is hosted on akamai networks ?

I configred a FW rule with the URL of the server as FQDN in the destination field and allowed downloads but since the content is hosted on akamai, the FW rule is ignored.

I don't want to give the user full download access to akamai networks...

How is it done on Palo Alto FW's ?

Re: how to whitelist Akamai downloads ?

Anon1 — Thu, 22 Nov 2018 20:11:07 GMT

Create a custom url category containing the needed url.

Then use it in the url category section of the firewall rule.

Use destination IP any.

The firewall will then allow the TCP handshake to any IP address and then when the first packet with payload comes it will compare the requested url against the url in the custom url category. If it matches, the session will be allowed. If not, the session will be closed.

Re: how to whitelist Akamai downloads ?

DaxVC — Mon, 26 Nov 2018 13:37:36 GMT

Thank you for the information.

I've created a FW rule keeping your tips in mind and it works like expected now.

Re: how to whitelist Akamai downloads ?

HW-ChrisME — Thu, 02 Apr 2020 06:36:03 GMT

I have the same question for the trend micro update services.

nslookup show me the akamai dns adress e16632.dscd.akamaiedge.net

Is this the right one for the security rule?

nslookup smex125-p.activeupdate.trendmicro.com

Nicht autorisierende Antwort:
Name: e16632.dscd.akamaiedge.net
Addresses: 2a02:26f0:fe00:1bb::40f8
2a02:26f0:fe00:1b6::40f8
2a02:26f0:fe00:180::40f8
2a02:26f0:fe00:1b7::40f8
2a02:26f0:fe00:1bf::40f8
95.100.198.74
Aliases: smex125-p.activeupdate.trendmicro.com
star-ds.activeupdate.trendmicro.com.edgekey.net

Re: how to whitelist Akamai downloads ?

JimMcGrady — Fri, 11 Jun 2021 08:25:35 GMT

I think i am missing something as my rule will not match traffic. I have created a custom URL category - akamai - with *.deploy.static.akamaitechnologies.com in its 'sites' list.

I then create a rule specifying the IP of my test machine (in zone trust) as permitted to reach any destination IP in the untrust zone.

Applications is set to 'any'. Under 'Service/URL Category' i have 'any' service and URL category 'akamai'

Re: how to whitelist Akamai downloads ?

S_Alad — Tue, 05 Apr 2022 16:23:02 GMT

It worked like a charm. thanks

Re: how to whitelist Akamai downloads ?

EddieJimenez — Tue, 15 Apr 2025 20:50:54 GMT

Hi Jim,

I'm curious if you've had any luck with this? This should be very straight forward, as you mentioned. I have done the same, I created a URL category for destinations for my software developers to be able to download packages without many file blocking restrictions. But the firewall has a difficult time categorizing *.deploy.static.akamaitechnologies.com to my custom URL category.

I'll try some more things and report back what I find.

Thanks,

Eddie