PBF based on URL Filtering/Application

[LeoLion]

hi everyone,

We have a PBF Rule allow all internal users to internet via our ISP1.

And I want to create another PBF rule on top of the above PBF rule to allow Instagram application traffic towards ISP2?

I look through the below KB but it is not doable: 
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clq1CAC

So i want to check if anyone have other alternative on this? Please advise!

[Raido_Rattameister]

Routing decision needs to be made based on first packet in session.

As first packet in session is SYN that don't include URL you cannot configure PBF based on URLs.

You could set create FQDN address object for instagram.com (and any other domains related to Instagram) and set PBF by placing those FQDNs into destination IP field.

[LeoLion]

are we able to create a willcard domain for instagram? Or we really need to create all the domain related to instagram?

[Raido_Rattameister]

You can't use wildcard as Palo needs to resolve those domains to IP address so taking this route you need to add every domain.

[LeoLion]

@Raido_Rattameister 

Noted on this method.

Do you have other alternative other than this?

[ozheng]

Hello LeoLion,

If you have SDWAN license on the firewall, you can set up some sdwan rules.

So you can set some rules on app-id.

Olivier