PAN 6.1: Filtering inbound traffic layer 7

[palomed]

If I expose a server to the Internet, can I limit traffic at the PAN so that only a specific path can be reached? 

Say permit www.hoho.com/foo.html but deny www.hoho.com/fa.html or any other path?

[jvalentine]

You could use a custom IPS signature that resets connection for traffic that matches the following conditions:

 - host = www.hoho.com or hoho.com

 - uri/path does NOT = foo.html (or does not contain foo.html, or does not equal to /path1/path2/foo.html, etc.) 

Matching against www.hoho.com and/or hoho.com will effectively "arm" the signature, and as if the path strays from what is allowed, it will fire, resetting the connection.  If the path matches what is allowed, then the connection will be allowed to flow normally. 

You could use a custom AppID signature instead.  The logic would be the same, but the policy would look different.  Instead of "permit web-browsing to webserver with "custom IPS signature" enabled", it would be "permit application=hoho-com to webserver"

Honestly not sure which one would be better... I'd recommend trying them both out to see which one more fully meets your needs.  

Does this server provide SSL or just HTTP?  If it's SSL, you'll also need to use an Inbound SSL Inspection profile so that the firewall can look inside of SSL and validate the /foo.html part.

Documentation for starting points:

 - https://live.paloaltonetworks.com/t5/Tech-Note-Articles/Creating-Custom-Threat-Signatures/ta-p/58569

 - https://live.paloaltonetworks.com/t5/Tech-Note-Articles/Custom-Application-Signatures/ta-p/58625