How to exempt certain destinations from a File Blocking policy

[ahopkins]

I need to exempt certain sites from a policy that blocks downloads of executables, so downloads of executables are allowed from those sites. Since these are large sites that use content distribution networks, I can't create a policy with a destination IP address and a different security profile. What I would do with other brands of firewall that support FQDN object types, is reference the destination domain or URL in the policy instead of a destination IP, but Palo Alto doesn't have that feature yet. Is there a workaround I can use until Palo Alto supports the URL or FQDN object type?

[rmonvon · Accepted solution]

You will need to be at PAN-OS version 3.1.0 or higher to use the above custom AppID as it has enhancements to support the CN in SSL cert.

For PAN-OS version 3.0.x, please try the attached custom AppID.  The signature is looking for microsoft.com in the HTTP host header or the uri path.  You can almost separate the 2 matching conditions into 2 separate custom appIDs to suit your needs.

good luck.

Message was edited by: rmonvon

[ahopkins]

That works, thanks!