URL Category and IP address blocks

[NGJ1]

Hi

I have inherited a system with a Custom URL Category that includes URLs and IPs, this is attached to a URL filtering profile that is set to block within a Security Profile Group. 

Can IP addresses really be added to a Custom URL Category, or are they simply for URL inspection.?

If so, does the firewall therefore only block the traffic if the IP is part of the URL?

Also, I know within Cisco Security Intelligence an FTD has a network policy list to drop early traffic, if an IP exists here, any traffic matching the IP is dropped before it gets to the ACL for further filtering.  Is there an equivalent within Palo Alto to list IPs that any matching traffic is dropped before any Security rule is processed.

Thanks

[OtakarKlier]

Hello,

Not IP's to the URL categories. Could be a separate security policy with the IP's as source or destination. But sounds like you want to block an internal server from internal users? I tend not to do URL filtering inside my network since it can cause issues, etc. What I use is user-id mapping so only users that should have access can even see the site.

Regards,

[NGJ1]

Hi. It is an external access rule for users to access the internet.  In addition to the URL filter Categories, we have another Custom URL list applied to the filtering policy to block URLs

My concern was are IPs meant to be added to a Custom URL Category, is that normal practice.

Thanks

[OtakarKlier · Accepted solution]

Hello,

For external access, I dont play IP whack-a-mole. Meaning IP's change too frequently so I go with the dynamic approaches. I use External Dynamic Lists that are built-in to block/allow certain groups etc.

https://docs.paloaltonetworks.com/pan-os/11-0/pan-os-admin/policy/use-an-external-dynamic-list-in-po...

Cheers!

[NGJ1]

Hi, good point, the EDL is the approach I will use going forward for these IP blocks.

Thanks