Transparent URL Filtering Only - Not Firewall

[mjensen323]

Are there any instructions or can someone shed some light on doing only URL filtering on the PA and not using it as a firewall yet.

[pulukas]

Are you setting this up with an existing firewall and inserting this in the path for URL filtering?

If so, you can use the v-wire instance that exists by default on most models.  This will insert on the trust side of your existing firewall to read all the outbound traffic.

Create two rules:

untrust to trust with allow all

trust to untrust with allow all and add your url filtering profile to this rule

I would also add a basic threat profile so you can get logging on this as well.

[mjensen323]

Thanks for the reply.

Does that mean the flow is this:

ASA Firewall -> Palo Alto -> Existing Network or does the vwire see traffic on a span and block it accordingly?

Thanks again.

[pulukas]

In order to block traffic you would need to be in-line as you indicate.

Palo Alto can be setup using a span port and the PA interface as a Tap.  But you can only report on traffic then you cannot block anything as you are only seeing a copy of the traffic not the actual flow.