If it matches the setting under 'URL Category', then it will decrypt the SSL session. The Decryption policy will check the 'Issued To CN' on the presented Certificate.

Decryption does not know the specific sub-page on the https site required to block, as it works in the same manner as a Security Policy. In a decryption policy, there is an URL category option. If not already implemented on the firewall, the goal is to configure the decryption to inspect the desired traffic. The session is ssl-encrypted, and the firewall cannot inspect it to apply the URL Filtering unless a decryption policy is enabled on the traffic.ĭecryption should be implemented with care. However, the problem with the URL Filtering Profile, is that the firewall needs to look into the session to be able to pick up the full URL. Since this is not desired result, a URL Filtering Profile needs to be configured. The example screenshot below shows the Common Name value as '*.'.Ī security policy can block '*.', but that will result in blocking the entire site. Note: With the release of PAN-OS 6.0, there is an additional match through the SNI field, which is presented on the SSL Client 'Hello message.' For further details refer to: Resolving URL Category in Decryption Policy When Multiple URLs are Behind the Same IP.

Using Security Policies and Custom URL Categories will only match the 'Issued To' Common Name (CN) on the certificate presented by the site.

URL filtering presents some challenges when blocking a specific HTTPS site and, at the same time, allowing everything else under that site.įor example, the requirement is to block ' ', but allow ' '.

Avast blocking sites after xp3 added