topic Custom URL Category and SSL Decryption in General Topics

Custom URL Category and SSL Decryption

CarmenGerardi — Tue, 02 Jul 2019 13:30:52 GMT

Hello all,

We have a custom URL category created to exclude sites from SSL decyption. We have the category set to no decrypt on the firewall but recently we encountered an issue where URLs that we add to the custom object were not getting categorized as such. We talked to PAN TAC and they recommended adding a "/" to the end of the URLs. We tested this and it seems to be working. Just curious if anyone has seen this before? We have never encountered this before with Custom URL Categories.

Thanks all!

Re: Custom URL Category and SSL Decryption

reaper — Tue, 02 Jul 2019 13:46:12 GMT

It depends on the URLs you're adding to the custom category. The entries are in regex format so some url's may 'register' differently than you'd expect https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/url-filtering/url-filtering-overview/block-and-allow-lists#

Re: Custom URL Category and SSL Decryption

birkhojk — Tue, 02 Jul 2019 14:20:25 GMT

Have not seen this. Was working with it yesterday, and as you know without Decryption enabled, you cannot even read the full URL; since, the Client Hello provies only the domain name. What I learned is to be able to see the URL in the Monitor tab, you need to enable URL filtering on the security policy that matches up with some decryption.

At any rate, we have been using a lot of * asterisks. For example: example.com/noaccess/*

Have you tried that?