URL exeptions best practis

[YGoldy]

Hi All.
I'm new in Palo Alto.
My goal is to exclude some IPs (Mainly some Broadcast TV channels) from scaning and intrusion ditection, for improving throughput.

Now there are some ways to achive this, but i wondwer what is the best way?

Regards'

Goldy

[TomYoung]

Hi @YGoldy ,

Great question.  I believe the best way is to create a new security policy rule with those destination IP addresses or URLs and attach either (1) no security profile or (2) a modified security profile to the rule.  You would definitely want to define the applications and services to strictly control the traffic allows.

Thanks,

Tom

[YGoldy]

Hi Tom.
Thanks For your respond.

This is decently one of the possibilities I was thinking about.
Another possibility I was thinking about, is to create URL Category with all those URLs and IPs, then create URL Profile which allow this category (together with other allowed and blocked category, and apply it to a policy.

The thing is what come first and what is more efficient and take less recourses.  

regards,

Goldy.

[TomYoung · Accepted solution]

Hi @YGoldy ,

You mentioned that you also wanted to exclude intrusion detection.  This may include Vulnerability, Antivirus, and other profiles and cannot be done entirely with a URL Filtering profile.

You could put a custom URL category as a destination in a security policy rule.  I didn't think that IP addresses could be put in a custom URL category, but this doc says you can.  https://docs.paloaltonetworks.com/advanced-url-filtering/administration/configuring-url-filtering/ur...

A custom URL category would make the security policy rule cleaner without the long list of URLs or IP addresses.

If this list will change frequently, you can use an EDL that you edit on a web server off the NGFW and do not have to commit with each change.  The NGFW can be configured to check the EDL every 5 minutes.  The doc above says a URL List type EDL can contain IP addresses and domains.  I did not know that either.

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/policy/use-an-external-dynamic-list-in-po...

Thanks,

Tom

[YGoldy]

Very nice 😊

Can you add EDL to URL Category?

Thanks,
Goldy

[TomYoung]

Hi @YGoldy ,

No.  Check out the links I posted.

Thanks,

Tom

[YGoldy]

Thanks 🙏