URL Filter Security Policy Structure

cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
We are conducting regularly scheduled maintenance over the weekend, which could cause some downtime on LIVEcommunity. We apologize for any inconvenience.

URL Filter Security Policy Structure

L0 Member

Hello all. New to PAN, and after reviewing the documentation on URL Filtering, I'm confused on the best practice deployment of the policy structure. Here's what I mean:

 

Let's say I want to break out the policies into multiple granular policies for custom exceptions. It would look something like this:

 

1) URL Filter Policy: "Vendor Safelist"

  • Custom URL Category "Vendor List": Allow
  • Everything else (pre-defined):???

2) URL Filer Policy "MISC Web"

  • Pre-Defined categories: Alert some
  • Pre-Defined categories: Block some

 

The way I'm understanding this is that if I access a vendor site, Profile #1 will match and allow it, but I don't want everything else to either block/allow/alert. I want the traffic for non-vendor URLs to progress down to the next policy so it can be processed by #2. 

 

The reason for this is to A) have some logical organization of the policies, and B) not have one massive policy to manage everything. What I'm asking today is that it seems like this structure isn't viable, and that only one massive policy can work. Am I missing something? 

2 REPLIES 2

L7 Applicator

URL filtering kicks in after traffic has already matched to the security policy.

 

You could test adding FQDN type address objects for "Vendor List" domains and place those FQDNs into "Vendor Safelist" policy destination address field.

 

In this case firewall will resolve those addresses to IP and "Vendor Safelist" policy will only match if traffic goes to IPs that host "Vendor List" websites.

Enterprise Architect, Security @ Cloud Carib Ltd
ACE, PCNSE, PCNSI

L1 Bithead

Hi Josh,

 

in your security policies you can add the url category as matching criteria under "Service / URL Category"

 

so you can build 2 security policies 

the first with your custom URL "Vendor List"

and the second one without the URL Category match.

 

On both you can apply the URL Filtering Profile that is needed.

 

Greetings

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!