TLS 1.3 Encrypted SNI No-Decrypt URL Categories

[Sec101]

In non decrypted tls 1.3 traffic, how is the firewall in 10.0 seeing the URL that a user requests and how is it enforcing that category?  I've read that tls1.3 encrypts the SNI field, which from my understanding, is the primary way the palo firewalls read and implement URL categories on non-decrypted traffic.   

If we don't decrypt on certain traffic (ex. financial), and that traffic is tls1.3, how is the firewall seeing a destination, other than an IP address, and how is it trying to utilize what it sees to a URL category?

I've read below, but still a bit foggy on this, as would this break URL categories period for non-decrypted traffic?

https://live.paloaltonetworks.com/t5/general-topics/url-filtering-tls-1-3-website/m-p/244821#M69839 

[BPry]

@Sec101

TLSv1.3 supports encrypting the SNI field, but there's additional work that needs to be done to do so and a lot of sites aren't doing so at this time. For sites that choose to encrypt the SNI field, I imagine that the traffic is simply decrypted until the firewall can see what the site actually is and then it stops for the remainder of the established session. I could be wrong on that, but that's about as far as you could handle that situation as far as TLSv1.3 with encrypted SNI is concerned. I might have to lab this up this weekend to see exactly how that functions. 

[Sec101]

Thank you for the reply!  Always good to hear from you.   

I'm wondering about the effectiveness of URL categories that are not decrypted on the firewall in a TLS1.3 world.  Do they become worthless?

Found the below link, but it still doesn't give a lot of info on the tls1.3 encrypted SNI.   

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClzlCAC