URL filtering is not functioning as expected.

[Jagdeep1]

Hello Team,

We are experiencing an issue with URL filtering on a Palo Alto PA-440 running version 11.1.4 -h7. Despite having valid licenses, URL filtering is not functioning as expected.

Here’s what we’ve tried so far:

1. Cleared the cache and deleted the URLs from the database multiple times.

2. Created rules with custom URL categories, ensuring all possible URLs and subdomains are included.

3. However, the traffic still hits the "interzone-deny" rule.

when we removed the security profiles and set "any any" in all fields, URL filtering worked. It appears that the URL filtering database might not be functioning properly.

Has anyone encountered a similar issue? Any suggestions or advice on how to resolve this?

Looking forward to your insights.

[ozheng]

Hello @Jagdeep1 ,

Can you provide more context on the security policy with an example?

Also do you have SSL decryption enabled?

Olivier

[jfernandez1]

I advise you to take a pcap of the traffic you are trying to allow and check the SNI field on the server certificate when connecting to the website, that specific field is the field the Palo sees to determine the URL in question, sometimes the SNI would be a non-related to the URL we think we are allowing