topic Re: Custom URL category not matching in security policy in General Topics

Custom URL category not matching in security policy

JimMcGrady — Wed, 18 Mar 2020 08:59:50 GMT

On my PA 9.1.0 firewall, Ive created a custom URL category 'Akamai' with a url list comprising *.deploy.static.akamaitechnologies.com

In my security policy i have a rule allowing any source (trust zone) to reach any destination (untrust zone) via any protocol and any application. The rule specifies 'Akamai' under the Services/URL category. log and allow is set. Any ideas why my rule is not matching? I see likely traffic falling through to a later rule.

Re: Custom URL category not matching in security policy

kiwi — Wed, 18 Mar 2020 09:10:15 GMT

Hi @JimMcGrady ,

Can you add some more details ?

Is it SSL traffic ? If so are you decrypting it correctly ? How is the traffic identified by the firewall ?

Cheers,

-Kiwi.

Re: Custom URL category not matching in security policy

JimMcGrady — Fri, 20 Mar 2020 08:45:23 GMT

It is https (ssl) traffic. I am not decrypting. However i would have thought the rule would match on URL rather than on content.

This is the procedure i have followed

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJKCA0

Re: Custom URL category not matching in security policy

kiwi — Fri, 20 Mar 2020 10:02:43 GMT

Hi @JimMcGrady ,

If you don't decrypt then the firewall can't see the url ... it will be encrypted.

In that case the firewall will rely on the certificate information or the SNI to identify the category.

URL CATEGORIZATION IN SSL AND POLICY LOOKUP WORK-FLOW

Cheers,

-Kiwi.