How to restrict user access to specific URLs without the use of SSL decryption in the URL filtering profile?

How to restrict user access to specific URLs without the use of SSL decryption in the URL filtering profile?

• Next Gen Firewalls (NGFW)
• Supported PAN-OS
• SSL Decryption
• URL Filtering

• If using SSL Decryption is not Possible. An alternative method can be used.
• As it is known, DNS traffic will traverse before HTTP.
• An alternative option is DNS Security. This option can be used if the category of the URL in question is not present in the DNS Security Policy.
  
  1. Create an EDL object under Object > External Dynamic Lists >  Add
   

2. Add the name of the EDL object and select Domain List under Type
    

3. Add the source URL where the EDL object will feed from 
   

4.  Choose alternative options such as Server Authentication / Check for updates, and click OK  
5. Add the EDL under Anti-Spyware >Select the Anti-Spyware Profile or Create a new one by clicking in 'Add" > DNS Policy > External dynamic list and select the action drop or sinkhole
   
6. Click OK, and then Commit.

Policy Object: External Dynamic Lists