URL Filter Security Policy Structure

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

URL Filter Security Policy Structure

L1 Bithead

Hello all. New to PAN, and after reviewing the documentation on URL Filtering, I'm confused on the best practice deployment of the policy structure. Here's what I mean:

 

Let's say I want to break out the policies into multiple granular policies for custom exceptions. It would look something like this:

 

1) URL Filter Policy: "Vendor Safelist"

  • Custom URL Category "Vendor List": Allow
  • Everything else (pre-defined):???

2) URL Filer Policy "MISC Web"

  • Pre-Defined categories: Alert some
  • Pre-Defined categories: Block some

 

The way I'm understanding this is that if I access a vendor site, Profile #1 will match and allow it, but I don't want everything else to either block/allow/alert. I want the traffic for non-vendor URLs to progress down to the next policy so it can be processed by #2. 

 

The reason for this is to A) have some logical organization of the policies, and B) not have one massive policy to manage everything. What I'm asking today is that it seems like this structure isn't viable, and that only one massive policy can work. Am I missing something? 

2 REPLIES 2

Cyber Elite
Cyber Elite

URL filtering kicks in after traffic has already matched to the security policy.

 

You could test adding FQDN type address objects for "Vendor List" domains and place those FQDNs into "Vendor Safelist" policy destination address field.

 

In this case firewall will resolve those addresses to IP and "Vendor Safelist" policy will only match if traffic goes to IPs that host "Vendor List" websites.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

L1 Bithead

Hi Josh,

 

in your security policies you can add the url category as matching criteria under "Service / URL Category"

 

so you can build 2 security policies 

the first with your custom URL "Vendor List"

and the second one without the URL Category match.

 

On both you can apply the URL Filtering Profile that is needed.

 

Greetings

  • 1993 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!