URL Category Versus URL Filtering Profile

Showing results for 
Show  only  | Search instead for 
Did you mean: 

URL Category Versus URL Filtering Profile

L1 Bithead

When would you use one over the other?


Cyber Elite
Cyber Elite

URL category in the destination of a security policy will work sort of like a dynamic IP list, it's going to allow a TCP handshake through based on the destination IP belonging to a category


URL filtering profile will not care about the session itself (that relies on a web-browsing policy) but will see which url is being accessed and then apply an action with a user-friendly interface if the action is 'negative': a block page will be presented for blocked categories, a continue page can be presented for 'questionable' categories and so on

Tom Piens
PANgurus - SASE and Strata specialist; (co)managed services, VAR and consultancy

L7 Applicator

URL Category in the security policy match criteria allows you to vary the security profiles based on the URL category.  Security profiles are things like AntiVirus Profiles, Vulnerability Profiles, WildFire Profiles, Anti-Spyware Profiles, File Blocking Profiles, Data Filtering Profiles, etc.  


One common use-case is to allow users to visit questionable URL categories, but restrict the file types they can download from those locations.


You need 2 security policy rules to accomplish this.  The first policy allows web-browsing with URL category = unknown/parked/insufficient, and then you attach a strict file blocking profile that prevents dangerous file types from being downloaded (PE, pdf, office, java, flash, etc.)  


The 2nd security policy is for web-browsing in general, no URL category match, but then you can attach a less restrictive file blocking profile that allows PDFs, office docs, etc.


This concept/tactic is discussed in a little more detail in the "Best Practices for Ransomware Prevention" document, Step #4, found here:

 - https://live.paloaltonetworks.com/t5/Featured-Articles/Best-Practices-for-Ransomware-Prevention/ta-p...


Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!