URL Category Versus URL Filtering Profile

[RodO]

When would you use one over the other?

[reaper]

URL category in the destination of a security policy will work sort of like a dynamic IP list, it's going to allow a TCP handshake through based on the destination IP belonging to a category

URL filtering profile will not care about the session itself (that relies on a web-browsing policy) but will see which url is being accessed and then apply an action with a user-friendly interface if the action is 'negative': a block page will be presented for blocked categories, a continue page can be presented for 'questionable' categories and so on

[jvalentine]

URL Category in the security policy match criteria allows you to vary the security profiles based on the URL category.  Security profiles are things like AntiVirus Profiles, Vulnerability Profiles, WildFire Profiles, Anti-Spyware Profiles, File Blocking Profiles, Data Filtering Profiles, etc.  

One common use-case is to allow users to visit questionable URL categories, but restrict the file types they can download from those locations.

You need 2 security policy rules to accomplish this.  The first policy allows web-browsing with URL category = unknown/parked/insufficient, and then you attach a strict file blocking profile that prevents dangerous file types from being downloaded (PE, pdf, office, java, flash, etc.)  

The 2nd security policy is for web-browsing in general, no URL category match, but then you can attach a less restrictive file blocking profile that allows PDFs, office docs, etc.

This concept/tactic is discussed in a little more detail in the "Best Practices for Ransomware Prevention" document, Step #4, found here:

 - https://live.paloaltonetworks.com/t5/Featured-Articles/Best-Practices-for-Ransomware-Prevention/ta-p...