Query on URL filtering

[amocherla]

I found this article on URL filtering.

My question is how is *.baidu.com not allowing mp3.baidu.com or news.baidu.com as well

What does *. signify or equate to this scenario.

ALso is there is any need or scenario in which we would need to add 

www.baidu.com

*.baidu.com as rules in Custom URL category.

Any Help would be appreciated.

HOW TO ALLOW ONE URL AND BLOCK OTHER ASSOCIATED URLS

11171

Created On 02/07/19 23:48 PM - Last Updated 02/07/19 23:48 PM

URL FILTERING

Resolution

Overview

This describes how to allow a single URL and block other associated URLs. In this example www.baidu.com will be allowed but mp3.baidu.com and news.baidu.com will be blocked.

Steps

Use one of the following two configuration options.

Option 1: Use URL Category

1. Go to Objects > Custom URL Category, and create a category called "Baidu," for example. Add "*.baidu.com" to the category.
2. Go to Objects > Custom URL Category, and create a category called "Everything," for example. Add "*" to the category. This will cover all URLs.
3. Add a security policy that permits from any to any.
4. Under Service/URL Category, add the category "Baidu."
5. Add another security policy that blocks from any to any. Under Service/URL Category add the category "Everything."
   The first rule should permit access to *.baidu.com, while the second rule should act as a catch-all rule that blocks access to all URLs.

Option 2: Use URL filtering

1. Go to Objects > Custom URL Category, and create a category called "Baidu" for example. Add "*.baidu.com" to the category.
2. Go to Objects > URL Filtering, and create a url filtering profile called "Baidu-URL."
3. Select the category "Baidu" to allow and the rest of the categories to block. This will block all URLs except www.baidu.com.
4. Add a security policy that permits from any to any. Under Actions > Profile Setting > Profile Type <select profiles>, select the url filtering profile "Baidu-URL."
   Note: This rule should only permit access to *.baidu.com.

owner:  bpappas

[OtakarKlier · Accepted solution]

Hello,

Looks like a typo in the document. *.baidu.com would allow mp3.baidu.com or news.baidu.com. 

Good catch!

[BPry · Accepted solution]

@amocherla,

As @OtakarKlier mentioned the document is wrong. *.baidu.com would still allow anything.baidu.com. You can however do this easily enough, you simply need to keep in mind the order of the firewall processes the request:

URL Filtering

1) Block List

2) Allow List

3) Custom Categories

4) Cache

5) Pre-Defined Categories

URL Categorie Actions:

1) Block

2) Override

3) Continue

4) Alert

5) Allow

I think this is what the article was trying to get at; one thing to keep in mind with the knowledgebase is that any Palo employee can make an entry, so they aren't always actually right. 

[amocherla]

Thank you for the explanation Bpry.

Is there any scenraio where you would right a URL rule like 

Both in Allow rule,

sega.com 

*.sega.com/*.   "This statement includes the First URL right, correct me If I am wrong.

Thank you