PANOS URL filtering 11.0.4

[zaidshaikh]

Hi folks,

We have URL filtering profile enabled on our respective policies using URL categories for different services purposes( eg: wsus services we have url category with *.microsoft.com and other doamins allowed in it, similarly for redhat and other devops related having separate url category called into respective source server policies for updates etc. )

Lets say i have enabled only wsus url category to alert in wsus related security rule which is having microsoft doamins and dependents alowed in it, and all other url category to block. Now since other url categories is blocked under this url profile. What i have observed is any url category (eg: github urlcategory having microsoft domain being blocked for this rule) containing micorsoft domain other than wsus url category (which is set to alert anyways), is getting blocked page for the wsus server updates access. 

When i observed the url filtering logs i can see the domain got blocked due to github url category having microsoft domain in it and is set to block for this particular rule.

Hence, i have to enable all the url category to alert having related domains in it to get it work.

Now, since github url category is having other domains also in it which does not required for wsus, is now getting open for wsus server to have access to, which is not desired.

So how i can make this work efficiently without allowing other domains getting indirectly enabled to servers which is not required.

Thanks

[Edsnow]

Hi @zaidshaikh ,

If I understood correctly, You can create URL category based policies instead of allowing the URLs under URL filtering Profile. 

[zaidshaikh]

Thank you for th response.

Do you mean calling the URL category under the service/url tab of the security policy?

[Edsnow]

Yes correct.