Traffic hitting policy rule it shouldn't

[Jonathanct]

Hi,

PanOS 9.1.0

I need to block traffic to certain websites and domains.

I created a URL Category object and put just one site inside (example.com).

I then created a firewall rule like this:

Source zone: LAN

Source address: any

Dest Zone: WAN

Dest address: any

Application: any

Service/URL Category: my URL Category Object

Action: ALLOW

(I put it on Allow because for at first I just wanted to check what traffic is hitting this rule).

I immediately noticed a very high hit count on the rule and when I viewed the rule logs I noticed it is allowing loads of traffic that doesn't relate to example.com

I'm affraid if I put this rule to Block it will block my outgoing traffic.

What am I missing 

[TravisC]

My testing shows that it works as intended. If your traffic was allowed after changing that rule to action 'Deny', I would look into the order of the security policy rules and make sure that another rule didn't allow the traffic.

[Jonathanct]

I don't have log at session start, only at session end.

And I checked again, and the traffic is allowed in a rule that is after my block rule.

So that's strange why the fw can't determine the URL category.

[TravisC]

What are the URL's in the URL category? Can you test with 'example.com'?

[Jonathanct]

For testing purposes I tried with 'sega.com' 🙂

[TravisC]

@Jonathanct 

The URL should be 'www.sega.com'.