topic Re: Block Category based on local group in General Topics

Block Category based on local group

nbctcp — Wed, 10 Jul 2019 01:20:22 GMT

INFO:
-Palo 3320 PanOS 8

GOALS:

I have list of users and groups in local palo database
I want to block SALES group to access porn sites but allow DIRECTOR group

QUESTIONS:

1. should I use subinterface

2. since director mac address can't be seen if using L3 switch then should I

a. use dynamic vlan mean wherever director go, he must authenticate and get the same vlan

b. is there a palo client software that will automatically tell palo that this pc belong to paloalto local user director1

Re: Block Category based on local group

BPry — Wed, 10 Jul 2019 19:13:51 GMT

@nbctcp,

Is Captive Portal or GlobalProtect not an option within your environment? That would be my 'prefered' way of doing user identification if you aren't utilizing anything sort of AD.

Re: Block Category based on local group

OtakarKlier — Wed, 10 Jul 2019 20:09:10 GMT

I agree with @BPry , use URL filtering and AD groups for this. I do it all the time.