HELP: How to block access to any site except those on a whitelist...

[LCMember4427]

Hi,

On a certain Zone I need to block access to anything else but these URLs on a whitelist like this:

edition.cnn.com/health
edition.cnn.com/travel
money.cnn.com/technology/

How can I do that most elegantly (I have a VM-100 with latest PanOS)

Thanks a lot for a quick reply on this, I have tried with URL filtering but to no avail...

Tor

[Remo]

1. Configure and enable TLS decryption*: https://www.paloaltonetworks.com/documentation/80/pan-os/pan-os/decryption/configure-ssl-forward-pro...
2. Create a custom URL category with your entries
3. Create a security policy where you add your custom URL category directly into your rule (in the service tab)
4. Do not create any other rule except a deny-all rule for that zone

*without TLS decryption you'll be only able to filter for the domainname but not edition.cnn.com/health

[LCMember4427]

Hi,

Thanks for the quick reply. 

I have actually tried to create a custom URL category as you suggest using create URL Filtering Profile / Override tab and entered the list of 'white' URL's in the left (Allow List) listbox. 

Secondly I added this profile to the Security policy for the Zone in question.  However, despite this, it unfortunately still allows traffic from any URL.

What am I missing..?

[Remo]

If you use your method: have you set every URL category to block?