topic Re: Experience with migration to PAN-OS 9 regarding URL filtering changes in General Topics

Experience with migration to PAN-OS 9 regarding URL filtering changes

Anon1 — Tue, 23 Jul 2019 14:09:30 GMT

Does anybody has experience with migration to PAN-OS 9 regarding URL filtering changes?

Today with PAN-OS 8.1

Url-Filtering Profile 1 with Override Allow list: Url 1, Url 2, Url 3

Url-Filtering Profile 2 with Override Allow list: Url 2, Url 3, Url 4

Url-Filtering Profile 3 with Override Allow list: Url 3, Url 4, Url 5

During migration to PAN-OS 9 (in which the Override Allow List was removed), I understand that for each Override Allow List, a separate Custom Url Category is created:

Custom Url Category 1:Url 1, Url 2, Url 3

Custom Url Category 2:Url 2, Url 3, Url 4

Custom Url Category 3:Url 3, Url 4, Url 5

which then are assigned to the respective Url Filtering Profile

Url-Filtering Profile 1: Custom Url Category 1 => Allow

Url-Filtering Profile 2: Custom Url Category 2 => Allow

Url-Filtering Profile 3: Custom Url Category 3 => Allow

How is the behaviour of the firewall now if the same Url, e.g. Url 3, belongs to multiple Custom Url Categories? Which one will match?

Here https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClzSCAS it says it can cause unpredictable results.

Here https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClsmCAC it says it will result in the most severe action.

Re: Experience with migration to PAN-OS 9 regarding URL filtering changes

BPry — Tue, 23 Jul 2019 18:09:53 GMT

@Anon1,

The most severe action will be taken, as one would expect. The first KB article that you mentioned either is poor at actually writing Regex or is unaware of how the matching multiple different categories is actually processed; I've never ran into "unpredictable" results due to multiple matching categories as long as the custom actually understands the actions they have set.

Re: Experience with migration to PAN-OS 9 regarding URL filtering changes

Anon1 — Wed, 24 Jul 2019 09:59:14 GMT

Hello BPry

thanks for your reply. Perhaps I better convert the Override lists to Custom Url categories before update to PAN-OS 9 ?

Re: Experience with migration to PAN-OS 9 regarding URL filtering changes

BPry — Wed, 24 Jul 2019 20:44:43 GMT

@Anon1,

The automatic conversion should work perfectly fine, but if you convert it ahead of time you don't really have to worry about it when you actually perform the upgrade.