Showing results for 
Search instead for 
Did you mean: 


L2 Linker

Does anyone have any ideas on how to permit access to Google Maps but block access to all other Google services? I have tried using a rule matching the Google-Maps application however it requires google-base which allows many other Google services. I have also tried using custom URLs for and; however, Google maps seems to require access to resources at


The customer is currently using a Squid proxy with detailed regex expressions to accomplish this. Below are some examples. They would like to remove the proxy and use the firewall only. 


acl ALLOWED_URL url_regex -i ^https?://$
acl ALLOWED_URL url_regex -i ^https?://
acl ALLOWED_URL url_regex -i ^https?://www\.google\.com/(maps|xjs)
acl ALLOWED_URL url_regex -i ^https?://www\.google\.com/s(earch)?\?tbm=map
acl ALLOWED_URL url_regex -i ^https?://www\.google\.com/gen_204\?oq=


Cyber Elite
Cyber Elite

Hi @j.moore


Why don't you add the same URLs (without regex) to your custom URL category?

I tried that. It doesn't seem to match on the full string. I think Custom URLs only support domains and subdomains, not the variables. 


You can't use variables for this. 

I figured that. What other options do I have? 


To do this easily and cleanly you don't really have any from the firewall directly. Google integrates all of their services pretty tightly and trying to limit all of Google but allowing Maps would require a very large amount of allowed URLs that will likely be constantly changing and breaking things. 

Using a squid proxy this is fairly straightforward. Hoping this might be accomplished using the PA firewall only. 

Cyber Elite
Cyber Elite

As they work with squid, did you add these urls to the custom url category?

Yes, but it fails to match the following.  I I think this is because PANOS only matches on domains, subdomains, and paths not Parameters.


Are you doing SSL Decryption? Without decryption, the firewall doesn't even see the HTTP request for the maps page, it only sees the hostname of the server they're connecting to, in this case it's as the host. Google uses a wildcard cert, so the response from the server is for * Since neither is distinguishing the maps service, there would be no way to allow maps but deny others.


PAN-DB does categorize on full URIs, not just domains and hosts. A good example of this is any of the test sites:


Both of those pages are on the same host and domain, but different paths. PAN-DB will categorize them appropriately.


But if you're not decrypting the SSL (TLS) traffic, the only thing the firewall will see is a TLS Client Hello that has "" but not the full URI.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!