Block HTTP/HTTPS access via IP

[Robynson]

Hello.

I would like to block access to my site (http/https) when it is made via IP.

I want to only allow access made by name.

Ex.: www.mysite.com <=> 1.2.3.4

https://1.2.3.4 => deny

https://www.mysite.com => allow

Is that possible with Palo Alto?

Thanks.

[BPry]

@Robynson,

Couple ways off hand:

* Custom URL Category assigned to the security policy allowing external access - This is by far the most effective way to accomplish what you're attempting to do since you're just trying to do it for your own website(s). 

* Blocking the unknown category - Same thing really, but you would assign a URL filtering profile on the external access entry that blocks medium-risk and unknown categories. You'd have to verify what effect this would have with your own URL logs, but direct IP access is always going to be labelled as medium-risk,unknown by the firewall. Blocking access to those would block direct IP access, but could cause issues depending on how your website(s) are actually categorized.

The one thing to be mindful of here is that you'd want to ensure that you actually look through your logs and create a separate URL Filtering profile to assign if you go with that second option. GlobalProtect's hip-check is sent directly to the IP address instead of the FQDN, so you don't want to just block medium-risk and unknown categories on the profile you use for all of your external access rules.