URL Filtering Clarification

[ScottF]

I have been wrestling with many people regarding URL filtering specified within the "Service/URL Category" tab of a security rule.  First off I don't have a URL license.  Let me continue... I have created a security rule that allows traffic to a URL (e.g. *.google.com).  I create a custom URL Category and specified both *.google.com and google.com in the definition.  I then created a security rule that allows traffic to the Internet using destination "Any" and specify the custom URL Category in the Service/URL Category tab.  App-ID and Service is set to "Any."  I do not have any profiles configured in the Actions tab.  I then create a deny any rule after the URL Category rule. 

When I go to www.google.com I get denied as I do with every other website I go to.  I'm being told that when you create a custom URL Category, that even without a license the traffic in this case should be allowed to www.google.com.  I have fiddled and tried like crazy to get it to work, but to no avail.  I even enabled a decryption rule for the traffic in hopes that the HTTP header would provide the necessary information.

So I come to the community for a definitive answer... If you don't have the URL license, should I be able to accomplish what I have described above and get to www.google.com while everything else is denied?

I await your responses...

[Raido_Rattameister]

Press F12 on in your browser.

On Network tab start capture.

This will show you from where browser will pull data.

It is not just google.dom domain.

Create new custom url category and add url *.* into it.

Create URL Filtering Security Profile.

Change your custom category to alert.

Create new policy that permits traffic.

Attach this URL Filtering profile to it.

This will enable logging of URLs.