About keklund

No - you've got it pretty clearly - thanks! Now I just need to work out which is the lesser of all those evils.  I may split the difference - PBF for students/unknown users through a transparent proxy (all traffic), while staff/teachers have normal access.  There are some testing/assessment sites that I wouldn't want to go through the proxy, but I have those as actual IP addresses so making that exception would be easy. Ideally PA would just get URL-rewrite in the PanOS, and that would solve this for me.  The word I have through my vendor is they are hoping to add forced safesearch to a release late this year.  Hopefully that opens up more generic rewrite capability. ... View more

Thanks for the info.  We are looking into generating a user-id event against AD as workaround for this.  This is for iPads primarily we are thinking a custom app that generates an LDAP login - "logout" would be changing the user-id to a user with no rights. ... View more

Yeah - I was afraid the FQDN was not going to resolve on the fly.  I thought they had a refresh mechanism for this now, but it may not have been actual address objects I was thinking of. I could require all clients to setup a forward proxy, but I'm trying to make this transparent to the end users (not all of the clients are under AD control).  Plus I'd have to deal with all the traffic going to the proxy, which I don't want, just youtube. I'm liking the idea of a dns-resolver pointing to the proxy.  Why would there be a caveat of worrying about setting YouTube IPs in the proxy?  Only traffic looking for *.youtube.com would hit the proxy, and the proxy should be able to handle the lookups normally to provide the content.  Or am I not understanding it correctly?  Would I be able to accomplish this on the PA itself, or just through setting my internal DNS servers to resolve the youtube.com domain? Thanks! ... View more