- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Hello all. New to PAN, and after reviewing the documentation on URL Filtering, I'm confused on the best practice deployment of the policy structure. Here's what I mean:
Let's say I want to break out the policies into multiple granular policies for custom exceptions. It would look something like this:
1) URL Filter Policy: "Vendor Safelist"
2) URL Filer Policy "MISC Web"
The way I'm understanding this is that if I access a vendor site, Profile #1 will match and allow it, but I don't want everything else to either block/allow/alert. I want the traffic for non-vendor URLs to progress down to the next policy so it can be processed by #2.
The reason for this is to A) have some logical organization of the policies, and B) not have one massive policy to manage everything. What I'm asking today is that it seems like this structure isn't viable, and that only one massive policy can work. Am I missing something?
URL filtering kicks in after traffic has already matched to the security policy.
You could test adding FQDN type address objects for "Vendor List" domains and place those FQDNs into "Vendor Safelist" policy destination address field.
In this case firewall will resolve those addresses to IP and "Vendor Safelist" policy will only match if traffic goes to IPs that host "Vendor List" websites.
in your security policies you can add the url category as matching criteria under "Service / URL Category"
so you can build 2 security policies
the first with your custom URL "Vendor List"
and the second one without the URL Category match.
On both you can apply the URL Filtering Profile that is needed.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!