block by Domain Suffix (.xxx)

[mjandin]

Looking for a way to block the domain suffix of .xxx

I've created a custom URL catagory with *.xxx (and I also tried *.xxx/) and that works....however It will also block a URL string with.xxx anywhere in the URL (i.e. www.google.com/news/foobar.xxxdsdfsdsld/index.htm).  Does anyone know of way to block a specific domain suffix .xxx instead of just matching the string anywhere in the URL?

any ideas?

[bdaussin]

Hi,

You should be able to modify your regex but II am not confident your PAN regex.

Otherwises, depending on your network design you could do the following :

Use de PanOS DNS proxy features and configure something like that :

All .xxx DNS request are sent to a non existing DNS server.

All others DNS request are sent to your regular DNS.

regards,

[Bart_Jocque]

You could also make a custom app for this by matching the domain in the context 'http-req-host-header'.

This allows you the use full regex expressions ( full regex is not possible in custom URL filters )