- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
12-20-2021 09:51 PM
Let's say we want to match a domain in a custom URL category or EDL, including all sub-domains. While most people would expect "youtube.com" to do the job, in a PAN-OS this would only match youtube.com and not content.youtube.com. To achieve the result we must include:
youtube.com
*.youtube.com
I can live with that... however in PAN-OS 10 admins are now served a recommendation to use an ending token such as ./?&=;+ when building custom URL categories in the web UI, and if such a token is not present the condition may match more than intended. The example provided for "xyz.com." (note the dot) will match xyz.com.random.com and a suggestion is given to enter the domain as 'xyz.com/.' (again note the dot).
I have two questions regarding this statement
1. Is the dot at the end of these statements a mistake? I'd expect "xyz.com." to match xyz.random.com but "xyz.com/." should only match any path on xyz.com beginning with a dot (e.g. ./index.html).
2. If so, does that mean all my implementations with "xyz.com" will be matching phishing domains like "xyz.com.random.com"? And why doesn't the same logic apply to subdomains i.e. "xyz.com" matches "random.xyz.com" as well as just "xyz.com".
3. I'm sure different people wrote these parts of the UI, because in the Custom URL Category box recommends just using a forward slash (no dot).
4. Clearly I cannot count
01-17-2022 01:06 AM
i think that last dot is a mistake
if you add a domain 'xyz.com' it could also match xyz.compooter.com (but not xyz.com.compooter.com) because you didn't 'terminate' after your tld and it simply matches characters in a token (anything between dots is a token). a dot at the end signifies there must be a dot followed by another token, so that would force some sort of tailing fqdn bit (xyz.com. = xyz.com.tld ) a slash at the end 'ends' the fqdn part/token as to prevent phishing and 'happy mistakes' (xyz.com/ will still match xyz.com and xyz.com/index.html but no longer xyz.compooter.com)
T
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!