Allow downloading from Akamai or other CDNs

[SARowe_NZ]

PANOS 8.1

Hi all - I have ongoing issues with trying to control downloading of files from CDNs. An easy example is .cab files used by Microsoft Office templates. When you download a template it goes off to a page off: templatesmetadata.office.net, but the actual file is stored in an Akamai cache.

I have a policy matching a custom URL category, allowing that (I've also tried *.office.net), URL. This policy has no file blocking profile.

This does not seem to work. However, if I exclude *.office.net from decryption it works around the issue and allows the download.

I don't understand why it would match for the no-decrypt policy, but not the URL category policy.

What is the correct and manageable way to allow downloads from CDNs where the container URL is known and trusted?

Thanks,
Shannon

[S.Cantwell]

Good Day

I am just thinking out loud here, yet if you created a policy that allowed outbound traffic and used the URL filtering as a security profile (instead of using your custom url category as a matching condition) you may have some better luck (I believe)

I typically use an application such as web-browsing and ssl in combination of a URL matching condition in my policies.

Maybe, if you find out what the application that is being used, when accessing the Akami, you could give this a shot.

But I still believe the category should be used in your URL filtering profile, even if you need to create a custom rule/category/profile for your downloads.

Hope this makes sense to you.  😛

[SARowe_NZ]

Thanks Steve!