URL Filter Security Policy Structure

[Josh_Morris]

Hello all. New to PAN, and after reviewing the documentation on URL Filtering, I'm confused on the best practice deployment of the policy structure. Here's what I mean:

Let's say I want to break out the policies into multiple granular policies for custom exceptions. It would look something like this:

1) URL Filter Policy: "Vendor Safelist"

• Custom URL Category "Vendor List": Allow
• Everything else (pre-defined):???

2) URL Filer Policy "MISC Web"

• Pre-Defined categories: Alert some
• Pre-Defined categories: Block some

The way I'm understanding this is that if I access a vendor site, Profile #1 will match and allow it, but I don't want everything else to either block/allow/alert. I want the traffic for non-vendor URLs to progress down to the next policy so it can be processed by #2. 

The reason for this is to A) have some logical organization of the policies, and B) not have one massive policy to manage everything. What I'm asking today is that it seems like this structure isn't viable, and that only one massive policy can work. Am I missing something? 

[Raido_Rattameister]

URL filtering kicks in after traffic has already matched to the security policy.

You could test adding FQDN type address objects for "Vendor List" domains and place those FQDNs into "Vendor Safelist" policy destination address field.

In this case firewall will resolve those addresses to IP and "Vendor Safelist" policy will only match if traffic goes to IPs that host "Vendor List" websites.

[JGriessmeier]

Hi Josh,

in your security policies you can add the url category as matching criteria under "Service / URL Category"

so you can build 2 security policies 

the first with your custom URL "Vendor List"

and the second one without the URL Category match.

On both you can apply the URL Filtering Profile that is needed.

Greetings