Hey @Blueearthfoods As a followup to @Brandon_Wertz message, you need to confirm you have the following User-ID concepts in place. 1. Can the firewall map IP addresses to usernames? https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/user-id/map-ip-addresses-to-users 2. Can the firewall map those usernames to groups? https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/user-id/map-users-to-groups If both are met, you can simply build your security policy as you normally would but under the "Source User" you can specify that AD group. At a high level for your requirement, you would have something like. Security policy to allow traffic outbound if the source user group is "block level 1", attach the relevant security profiles to the rule to block the "bad stuff" including a URL filtering profile which is blocking the recommended categories: Phishing, Malware, Command and Control etc. https://docs.paloaltonetworks.com/best-practices/8-1/internet-gateway-best-practices/best-practice-internet-gateway-security-policy/create-best-practice-security-profiles For the second requirement, you would create a new custom URL category for your whitelist, add all your sites there. Add a new policy to allow traffic if they are going to this URL category for users in group "block level 2" Add a new policy below this policy to block everything from the user group "block level 2" https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/url-filtering/url-filtering-concepts/url-category-as-policy-match-criteria Cheers, Luke.
... View more
