URL Filtering Clarification

Showing results for 
Show  only  | Search instead for 
Did you mean: 

URL Filtering Clarification

L1 Bithead

I have been wrestling with many people regarding URL filtering specified within the "Service/URL Category" tab of a security rule.  First off I don't have a URL license.  Let me continue... I have created a security rule that allows traffic to a URL (e.g. *.google.com).  I create a custom URL Category and specified both *.google.com and google.com in the definition.  I then created a security rule that allows traffic to the Internet using destination "Any" and specify the custom URL Category in the Service/URL Category tab.  App-ID and Service is set to "Any."  I do not have any profiles configured in the Actions tab.  I then create a deny any rule after the URL Category rule. 


When I go to www.google.com I get denied as I do with every other website I go to.  I'm being told that when you create a custom URL Category, that even without a license the traffic in this case should be allowed to www.google.com.  I have fiddled and tried like crazy to get it to work, but to no avail.  I even enabled a decryption rule for the traffic in hopes that the HTTP header would provide the necessary information.


So I come to the community for a definitive answer... If you don't have the URL license, should I be able to accomplish what I have described above and get to www.google.com while everything else is denied?


I await your responses...


Cyber Elite
Cyber Elite

Press F12 on in your browser.

On Network tab start capture.

This will show you from where browser will pull data.

It is not just google.dom domain.


Create new custom url category and add url *.* into it.

Create URL Filtering Security Profile.

Change your custom category to alert.

Create new policy that permits traffic.

Attach this URL Filtering profile to it.

This will enable logging of URLs.

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!