URL Category - Is a trailing / necessary when adding sites?

[deeryolk]

This question relates to the creation of URL Category objects. When adding a new site, PAN-OS shows the following disclaimer:

"For domain entries, we recommend you use an ending token. Acceptable tokens are: . / ? & = ; +. If you choose not to use an ending token, you may block or allow more URLs than anticipated. For example, if you want to allow xyz.com and enter the domain as 'xyz.com,' you will allow xyz.com and URLs such as xyz.com.random.com. However, if you enter the domain as 'xyz.com/,' you will only allow xyz.com."

However, this seems to conflict with the Advanced URL Filtering guidelines here: Guidelines for URL Category Exceptions

See attached images.

The guidelines say:

"The firewall appends a trailing slash to the entry, limiting matches to the exact domain and its subdirectories."

Seeming to suggest that appending a trailing slash (/) is not necessary, as the firewall will implicitly add a trailing slash, even if you do not add it.

But then the disclaimer tells me I should add it explicitly.

My question. I want to have an entry that

match:
google.com/
google.com
google.com/sub1
google.com/sub1/sub2

does NOT match:
google.com.example.eu

Should I use

google.com/

OR

google.com

OR

are they equivalent in execution (which the docs seem to suggest)?

[reaper · Accepted solution]

in older PANOS versions the trailing slash was necessary to end the entry

newer PANOS versions add that trailing slash automatically, but you can turn this feature off at which time you again need to add the trailing slash manually

you can find that feature toggle in Device > Setup > Content-ID > URL Filtering >  Append Trailing Slash

hope that helps

[deeryolk]

Clear, thank you for your response!