Palo Alto wildcards for whitelist

[Kc_Dodds]

I’m on panorama 10.2.12h-2 and have a silly question but after reading through the Palo Alto articles am a bit confused as I guess I don’t understand the difference between a URLs path vs subdomains

I'm trying to whitelist https://app.e.dnv.com/e/bfs?s=861531437&lguid     (<note not the full path for time and sanity reasons) but when I added *.app.e.dnv.com/ to the existing whitelist it does not seem to match? Is there a reason for this or what am I doing wrong?

Ive tried adding 

*.app.e.dnv.com/

*.app.e.dnv.com/e/

app.e.dnv.com/

I believe the first should match the url requested but it does not seem to/it’s still being blocked? The second was more of just a dummy change as the / at the end of the first should match the rest of the path or subdirectory's like /e/etc in the url the third is just a precautionary one to make sure they weren’t just pasting the URL into the browser.

why is the first wild card not matching the rest of the url 

[ozheng · Accepted solution]

Hello @Kc_Dodds ,

The first entry will only match any subdomain to .app.e.dnv.com, for instance a.app.e.dnv.com/ .

Because you have the *. at the beginning of the expression, app.e.dnv.com will fail because of the missing before app.

Hope that helps.

Olivier