topic Re: Use URL filtering and Regional blocks in General Topics

Use URL filtering and Regional blocks

djldenayer — Tue, 18 Aug 2020 19:03:31 GMT

We block Regions at the moment, so traffic going to Russian IPs are dropped. But lets say that I now need to allow a specific URL to be allowed to Russia. If I make a rule above our block rule that has a custom URL category associated with it and define HTTPS as the service. Will that now force layer 7 inspection on all of that traffic? Or was it always getting layer 7 inspected so it doesn't matter? and do I need to concern myself with any of the URL Category "any" traffic that seems to always be generated.

Re: Use URL filtering and Regional blocks

VarunRao — Wed, 19 Aug 2020 02:09:20 GMT

This would be difficult to do, since IPs can be blocked through policies but URLs have different IPs coming from. A single url can be redirected through multiple IPs. If you know the exact IP for the URL then you can definitely do it by blocking the region in your policy although having a specific IP allowed in the above policy.

Maybe url allow/bock can be better handled through a DNS than the firewall. Firewall would work more on IP blocks from that region.

There are still a few docs available on Country blocks below:

https://live.paloaltonetworks.com/t5/blogs/geolocation-and-geoblocking/ba-p/315433

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClJWCA0

https://live.paloaltonetworks.com/t5/threat-vulnerability-discussions/block-all-countries-except-two-us-and-india/td-p/196301

Hope this helps,

Re: Use URL filtering and Regional blocks

Joshan_Lakhani — Mon, 09 Nov 2020 06:38:57 GMT

you can block the URL by using FQDN. Create the address object and use give the URLs.