topic Custom URL Filter - Site Definition Format in General Topics

Custom URL Filter - Site Definition Format

michaelmertens — Thu, 28 Mar 2019 11:13:54 GMT

We started using Custom URL Categories, and it seems when we define a site, we have to add both a wild card to cover any subdomain, and a / to cover all URI/URL of the domain, IE:

*.acme.corp (To cover subdomains)

acme.corp/ (To cover all URLs/URIs to the domain)

My question is (I'm getting into this deployed late) is that my predecessor said that combining the two did not seem to work:

*.acme.corp/

Does this seem to be the case via people's experience?

Thanks!

Mike

Re: Custom URL Filter - Site Definition Format

Brandon_Wertz — Thu, 28 Mar 2019 14:58:28 GMT

You need both. You were correct in writing:

*.acme.corp (To cover subdomains)

acme.corp/ (To cover all URLs/URIs to the domain)

*.acme.corp = anything coming before (.) acme.corp and anything under that variation

*.acme.corp will not = anything acme.corp and anything after.

The asterisk is a wildcard.

Re: Custom URL Filter - Site Definition Format

reaper — Thu, 28 Mar 2019 15:54:20 GMT

Hi Mike

here's an article on wildcard guidelines: https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-admin/url-filtering/url-category-exception-lists

/ is used as a token separator to prevent your tld being part of a larger domain

eg. 'my.com'

could also hit

my.company.com

so you can add the / to 'end' the string

wildcards like * should not influence that (make sure to not use wildcards at the end of a string)

Re: Custom URL Filter - Site Definition Format

Retired Member — Fri, 29 Mar 2019 09:03:57 GMT

Hi reaper.

I was a bit surprised about this information that my.com could hit my.company.com and figured I had to update lots and lots of entries in our custom categories but I'm unable to repeat this behaviour on PanOS 8.0.16. I actually created the fqdns my.com and my.company.com so they are resolvable and put only my.com in a custom URL category called "molndal-block".

When testing the fqdns with a browser (tried several) my.com triggers on the custom category but my.company.com does not?

Logs:

Im guessing this result might depend on if the browser adds a "/" the the end of the fqdn or not? (every browser I'v tried does this tho) or is there some flaw in my testing?