advanced url filtering question

[Martin_Chung]

https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resour...

how can i configure the firewall with Advanced URL filtering license to protect the following item

> Antievasion

> Phishing Protection

> Real-Time Web Protection

from my machine , i just find a setting in inline categorization.

checked "enable local inline categorization"
checked "enable cloud inline categorization"

please help

[JayGolf · Accepted solution]

Hi @Martin_Chung ,

In classic URL filtering, the firewall relies on a database for category determination. Here’s how it works:

Classic URL Filtering Workflow:

1. A user makes a URL request.
2. PAN-OS uses the URL Filtering license to check the PAN-DB for the category.
3. PAN-OS receives the verdict from PAN-DB and enforces the action defined in your URL Filtering Profile.

By enabling Local and Cloud Inline Categorization, you are enabling the firewall to forward URL requests over to ML detection engine that analyzes URLs in real-time. 

Advanced URL Filtering Workflow:

1. A user makes a URL request.
2. PAN-OS uses the URL Filtering license to check the PAN-DB for the category.
3. If needed, PAN-DB forwards the URL request to the real-time detection engine for inline analysis.
4. The inline ML engine determines a verdict and appends a subcategory to the PAN-DB category.
5. PAN-OS receives the updated verdict and enforces the action defined in your URL Filtering Profile.

To protect against anti-evasion, phishing, ensure real-time web protection, and more:

1. Review each URL Filtering Profile applied to your security policies.
2. Ensure malicious URL categories (phishing, malware, c2) are set to block.
3. For the Unknown and Real-Time Detection categories, set the action to alert or block, depending on your organization's risk tolerance.

TL:DR The firewall enforces whatever your URL Filtering Profile category actions are set to. Ensure categories like phishing, malware, and command-and-control are set to block, and configure Unknown and Real-Time Detection to alert or block for maximum protection. 

Cheers!