About Jonathanct

So I changed it to 'www.sega.com' and it worked! thanks! 🙂   So if I was asked to block domains such as abc.com, def.com, ghe.com etc., I must put 'www' at the begining if it's not actually necessery for normal browsing?   Also, does using URL category in policy rules make the PaloAlto perform a reverse DNS lookup on each packet going through the system? and if so doesn't it have a big impact on performace? ... View more

For testing purposes I tried with 'sega.com' 🙂 ... View more

I don't have log at session start, only at session end. And I checked again, and the traffic is allowed in a rule that is after my block rule. So that's strange why the fw can't determine the URL category. ... View more

@TravisC    So, I tried switching it to Deny but it didn't do anything. The hit count didn't change and in the monitor I can see it doesn't recognize the URL Category, it's registered as "Any". I also tried using custom EDL URL List instead of URL Category object, but got same result.   What am I missing?   ... View more

Hi @TravisC   Thanks for your reply. I'm not talking just about the hit count. I'm also talking about seeing the traffic in the monitor when clicking on the rule and choosing "Log Viewer".   You're saying the session is initially allowed before the URL can be deteremined, so if I change it to DENY, wouldn't it first deny all traffic before detemining the URL Category? ... View more

  @JoergSchuetter     Actually, I just tried what you suggested but I can't see my EDL Domain LIst on the "Service/URL Category" tab as well.   Also, I'll explain why I wanted to doube check about how to create the rule:  I tried to create a URL Category object which contains only one URL (let's say example.com)  and I put it in a policy rule like this: Source zone:   LAN Source address:   any Dest Zone:   WAN Dest address:   any Application:   any Service/URL Category:   my URL Category Object Action:   ALLOW (I put it on Allow because for starters, I just wanted to check who is hitting this rule) When I followed the rule logs I noticed it is getting loads of hits that doesn't relate to example.com I'm affraid if I put this rule to Block it will block my outgoing traffic.   So same question for thecase of using EDL Domain List. ... View more

Hi @JoergSchuetter , So both Domain List EDL and URL List EDL should be put in the "Service/URL Category"? And just to make sure, my blocking rule would look like that:   Source zone: LAN Source address: any Dest Zone: WAN Dest address: any Application: any Service/URL Category: my EDL Domain List Action: Drop ... View more