How to Create Custom URL Categories

Palo Alto Firewall

Overview

This document describes the steps to create a Custom URL Category list, use the list in a URL Filtering profile, and then applying the profile in a security policy.

Steps

1. Go to Objects > URL Category and click Add
   
2. Fill in the Name, Description, and the URLs of the category members (one per line).
   Note: A list of URLs can also be imported from a file.
3. How to create the custom URL from CLI
   

   admin@pa-vm# set profiles custom-url-category NEW_URL
   
   [edit]
   admin@pa-vm# edit profiles custom-url-category NEW_URL
   [edit profiles custom-url-category NEW_URL]
   admin@pa-vm# set list "google.com gmail.com" type "URL List"
   
   [edit profiles custom-url-category NEW_URL]
   admin@pa-vm# set list "*.gmail.com" type "URL List"
   
   [edit profiles custom-url-category NEW_URL]
   admin@pa-vm# show
   NEW_URL {
     list [ "google.com gmail.com" *.gmail.com];
     type "URL List";
   }
   [edit profiles custom-url-category NEW_URL]
   admin@pa-vm#

    

To apply the custom category to a URL filtering profile:

1. Go to Objects > Security Profiles > URL Filtering and click Add.
2. Name the profile and select the custom category.
   (Note: The newly created category appears in the Category list with an asterisk next to it.)
   
   
3. Optionally, add URLs to the Allow/Block lists as appropriate.
4. How to check in CLI
   

   admin@pa-vm# show profiles custom-url-category Testing
   Testing {
     list [ crowdstrike.com microsoft.com talosintelligence.com httpvshttps.com httpforever.com *.microsoft.com microsoft.com/* github.com wcpstatic.microsoft.com/ *.github.com github.com/* *.s-microsoft.com google.com];
     type "URL List";
   }
   [edit]
   admin@pa-vm#

To apply the URL filtering profile in a security policy:

1. Go to Policies > Security
2. Select or create a security policy
3. Select the custom profile for URL Filtering, under Profile Settings:
   
   
4. Commit the changes to the firewall to take effect.

The Palo Alto Networks firewall will process the filter as follows:

• Block list
• Allow list
• Custom category
• Pre-defined category

owner: panagent

• Customers can also submit a URL Category Change Request via the URL Filtering (Test-a-Site) link below:
  • https://urlfiltering.paloaltonetworks.com/
• Alternatively, the customer can also submit a Support Case with TAC to review the URL and make a potential category change request.