https://live.paloaltonetworks.com/t5/general-topics/policy-order-how-to-allow-url-categories-ahead-of-an-ip/m-p/245935#M70066 <P>We have IP Blocklists before the rules for Web Browsing.&nbsp; However, we need to allow some URLs that would otherwise be blocked in the IP Blocklist (subsites of Weebly, don't get me started).&nbsp; Right now I have a Policy above the blocklist that alertss http/https with Service/URL Category/URL Category set for the Custom URL Category for the exemptions.&nbsp; It works, but thousands of other traffic is also applied to it for incomplete application (packet stream ends and it gets applied since it is so high in the list).&nbsp; Can anyone think of a cleaner way to do this?&nbsp; Thanks in advance.</P> Mon, 14 Jan 2019 17:11:55 GMT KMullenYC 2019-01-14T17:11:55Z https://live.paloaltonetworks.com/t5/general-topics/policy-order-how-to-allow-url-categories-ahead-of-an-ip/m-p/245935#M70066 <P>We have IP Blocklists before the rules for Web Browsing.&nbsp; However, we need to allow some URLs that would otherwise be blocked in the IP Blocklist (subsites of Weebly, don't get me started).&nbsp; Right now I have a Policy above the blocklist that alertss http/https with Service/URL Category/URL Category set for the Custom URL Category for the exemptions.&nbsp; It works, but thousands of other traffic is also applied to it for incomplete application (packet stream ends and it gets applied since it is so high in the list).&nbsp; Can anyone think of a cleaner way to do this?&nbsp; Thanks in advance.</P> Mon, 14 Jan 2019 17:11:55 GMT https://live.paloaltonetworks.com/t5/general-topics/policy-order-how-to-allow-url-categories-ahead-of-an-ip/m-p/245935#M70066 KMullenYC 2019-01-14T17:11:55Z https://live.paloaltonetworks.com/t5/general-topics/policy-order-how-to-allow-url-categories-ahead-of-an-ip/m-p/245952#M70069 <P><a href="https://live.paloaltonetworks.com/t5/user/viewprofilepage/user-id/78733">@KMullenYC</a>,</P><P>You won't really have a clean way of doing this. The firewall has to allow a handshake to take place so it can actually analyze the URL information to see if it's supposed to match the policy.&nbsp;</P> Mon, 14 Jan 2019 18:05:50 GMT https://live.paloaltonetworks.com/t5/general-topics/policy-order-how-to-allow-url-categories-ahead-of-an-ip/m-p/245952#M70069 BPry 2019-01-14T18:05:50Z