Custom URL Category issue

[FarzanaMustafa]

Hello,

We have followed this guide: 

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClIPCA0

Decrypt portion is working well. However we are finding the custom category and its contents although set to block, are not blocking https unless its in the block override.

Example url HTTP results in below block: Correct categorisation block

HTTPS version of the same url (although decrypted) gets blocked by the override block-list from the catchall policy I have in place.

[BPry]

@FarzanaMustafa,

Look at your system logs and verify that you are actually hitting the proper security policy where the URL category is applied. If you are not, then please post the entry you are actually trying to map on and the URL that isn't being caught. 

[FarzanaMustafa]

Hi @BPry 

Thank you for the response. We were able to make it work by changing the Service type to 'any' instead of 'application-default'.

However, this is not good as it allows app-ids to high risk profiles. 

What is the best practice to structure our rules below?

[BPry]

@FarzanaMustafa,

I'd really need to take a look at your application filters and see what applications they are matching to be sure; but when you start decrypting traffic one of the primary issues you'll run across is that web-browsing will map to tcp-443 (due to decryption) and that doesn't work with application-default policies. 

I would try your same policy, but make a subsequent policy that allows web-browsing on service object service-https and see if that doesn't fix the issues that you were running into without the 'any' policy. 

[FarzanaMustafa · Accepted solution]

@BPry 

Thank you for your help.

Noticing the destination nat port, we modified the security policy to be App-id = web-browsing and Service = custom service group of port 80 and 443.  This appears to have resolve the issue.