Dynamic URL Filtering when policy matching on URL

[LCMember2860]

Hi,

We're using dynamic URL filtering (ie the "cloud" database") within our URL-filtering profiles.  Within PAN-OS 4.1 there is now the option to match on URL category within security policies, but no checkbox there to use the Dynamic Filtering.  So, if I try and access a URL thats not in the local database, does the firewall still go and query the cloud for that policy?

tks

Liam.

[mikand]

I think the dynamic filtering is a global option in order to if you want to "leak" to the cloud which urls your clients are browsing to or not (along with to get a better hitrate since the downloadable db of url-categories are just the top1000 or similar per category).

But I could agree that it might be a nice feature to be able to do this both on global but also at security rule level - the question here will then be, which setting will be the judging one? Will the global setting overrule the local security rule setting or would the local security rule setting overrule the global setting?

[dyang · Accepted solution]

Hi Liam,

Excellent point - we also discovered this recently and the bug fix is targeted for the next maintenance release.  You should find more information in the release notes once it is available, but I'll also post more information at that time.

Thanks,

Doris

[dyang]

Hi Liam,

You may have noticed it already, but the aforementioned bug was addressed in the 4.1.3 release, which is now generally available.  If you are using URL categories as part of your match criteria and would like to enable dynamic lookups as part of that process, you can use the following CLI command to do so:

set devconfig setting url dynamic-url yes

Hope this helps,

Doris