Allow Access To Certain URLs Matching A Blocked URL Category
51217
Created On 02/13/21 02:15 AM - Last Modified 02/05/25 22:23 PM
Symptom
Assuming the URL category 'news' is being blocked by URL filtering. However, there is a business need to allow the URL reddit.com/r/paloaltonetworks but this is also being blocked.
Environment
- All versions of PAN-OS
- URL filtering profile in security policy
- Decryption is enabled
Cause
There is currently no way of achieving this through URL filtering because filtering on predefined categories is all-or-nothing. The traffic matches a policy that has a filter for blocking 'news' sites:
Policies --> Security --> Name --> Actions:
Resolution
- Create a custom URL object.
- Create a new security policy and add this object to the Service/URL Category tab of the security policy. This security rule must be placed above the existing policy.
- Commit the change.
Users should now be able to access the allowed URL:
Additional Information
This article assumes that the reader is familiar with URL filtering and SSL decryption.