Palo Alto URL Filter

 

In addition to the standard URL categories, there are 3 more system-defined categories:

• not-resolved - The website was not found in the local URL filtering database and cloud connectivity was not possible. We will talk later in this document about the connectivity to the cloud and the way it works.
• private-ip-address - Either the website is a single domain, the IP address is in a private IP range, or the URL Root domain is unknown to the cloud.
• unknown - The website has not been categorized yet.

URL filtering works on 2 major protocols: HTTP and HTTPS(SSL). In order to identify a certain category for a website, the firewall must do a query in the following order:

• It checks its local data plane cache.
• If no match is found, it checks its local management plane cache.
• If no match is found, it performs a query to the cloud (public or private).

For HTTP traffic, the firewall is going to look primarily at the HTTP GET message.

For HTTPS traffic, since this protocol is being encrypted, the firewall usually looks at data inside the Server Certificate that is presented to the client during the SSL handshake. In the case of decryption, this traffic will be treated as normal HTTP traffic when it comes to identifying the category.

For SSL, there are more fields and options that the firewall is trying to look for.

> test url www.google.com

> show url-cloud status

==========

You can block access to malicious or inappropriate websites in two ways

1. Create a rules with a Deny Action and use URL categories as part of the rule criteria.

2. Create a URL Filtering Profile that includes blocked categories and apply the Profile to a 
Security Policy rule that allows the web-browsing and ssl applications

When access https://www.hacker9.com and SSL decryption is applied:

with policy blocking: 

URL Filtering log: 

Traffic log, sessions end reason is "policy-deny"

Policy allowing with URL Profile blocking:

Traffic log, session end reason is "threat", but entry is in Threat log.

URL Filtering log:

URL filter log is same regardless the which way is used to block.