URL Filtering Test Pages

272160

Created On 09/25/18 19:36 PM - Last Modified 03/12/24 15:07 PM

URL Filtering Profile

URL Filtering

8.1

9.1

10.0

PAN-OS

Symptom

You have installed a new URL filtering or Advance URL filtering license and wanted to test if the URL filtering is working correctly.
You wanted to debug the security policy and needed some test URLs to visit to verify if the URL filter and security policy are working correctly.

Environment

Any PAN-OS( Advance URL filtering only works with PAN-OS 9.0 and above)
Palo Alto Firewall.
URL Filtering.

Cause

How do I test whether our URL Filtering service properly enforces my organization’s policies for malicious and benign URLs?Palo Alto Networks provide these test URL pages whenever a new category is added.

Resolution

The testing has been done on a category based.

Benign categories: Visit the website to see if the designed policy is logged and enforced. You will see harmless categories like webmail, sports, and shopping.
Non-benign (Gray, malware, and phishing area): For testing Gray areas such as adult or restrictive sites, it is not advisable to visit them. Palo Alto Networks has created test URLs for all categories. These testing URLs are 100% benign and have been categorized into their respective categories for testing purposes.
- For example, For the command-and-control category, the URLs is http://urlfiltering.paloaltonetworks.com/test-command-and-control . You will see respective logs; the following "blocked-continue page" will be displayed if the policy is configured as block-continue access to command-and-control categorized.

Screen Shot 2018-01-31 at 1.12.21 PM.png

Another example, For social networking, you can visit: https://urlfiltering.paloaltonetworks.com/test-social-networking, and if your policy is to allow access to this category, you will see the following result. ( decryption needed for HTTPS sites that have patterns like /test-social-networking)

Screen Shot 2018-01-31 at 1.14.49 PM.png

URLs can have four categories Risk level, content, Function, and Security Assessment, as defined below with examples. We have test URLs for all the cases.

Risk level( high risk, medium or low risk)
Content (i.e., motor vehicles)
Function/Behavior (i.e., personal-sites-and-blogs)
Security Assessment (i.e., Newly Registered Domain, malware, phishing)

Test pages for low, medium, and high-risk categories:

http://urlfiltering.paloaltonetworks.com/test-low-risk
http://urlfiltering.paloaltonetworks.com/test-medium-risk
http://urlfiltering.paloaltonetworks.com/test-high-risk

Test pages for malicious categories:

http://urlfiltering.paloaltonetworks.com/test-malware
http://urlfiltering.paloaltonetworks.com/test-phishing
http://urlfiltering.paloaltonetworks.com/test-command-and-control
http://urlfiltering.paloaltonetworks.com/test-ransomware (Refer Ransomware )

Test pages for newly registered domains:

https://urlfiltering.paloaltonetworks.com/test-newly-registered-domains

Test pages non-malicious categories:

List of test malicious categories for Advanced URL Filtering:

http://urlfiltering.paloaltonetworks.com/test-real-time-detection-command-and-control
http://urlfiltering.paloaltonetworks.com/test-real-time-detection-malware
http://urlfiltering.paloaltonetworks.com/test-real-time-detection-phishing
http://urlfiltering.paloaltonetworks.com/test-real-time-detection-grayware

Additional Information

Notes:

All the above links also work with HTTPS connections. Replace http:// with https://.
For HTTPS sites, decryption is needed.
If the website is malicious from SNI, decryption is not needed to action it.