URL Filtering based on AD Group membership

[sussexdowns]

I'm trying to created a URL filter that only applies to a specific AD Group.

I have a URL filter that applies to all known and unknown users, but it's fairly restrictive.  I have a group of users that require a slightly less restrictive URL filter.

These users are all currently a member of a specific AD group, and I'd like to apply the less restictive URL filter to that group.

I can make it work if I specify the AD users individually in the policy that applies the URL filter, but if I add the group it stops working.

Any suggestions would be greatly appreciated.

[ssarcar]

Sus

In your DC take a look if the “User Identification Agent”  filtering out all Ad groups and using only AD users. If that is the case then you can add the group . I think that will solve your problem.

[sussexdowns]

Hi ssarcar,

Thank for replying.

I can add the AD group to the policy but it member of that group we still being affected by the more restrictive policy, which is applied by the next rule.

Although at the moment its all a moot point, as the less restrictive rule has stopped working all together, and the Palo is marking it as an unused rule.