Configure URL Filtering (PAN-OS & Panorama)

1. Create a URL Filtering profile.

   If you didn’t already, configure a best practice URL Filtering profile to ensure protection against URLs hosting malware or exploitive content.

   Select ObjectsSecurity ProfilesURL Filtering and Add or modify a URL Filtering profile.
2. Define site access for each URL category.

   Select Categories, and then set Site Access:

   • Select Allow to permit traffic destined for the URL category; this traffic is not logged.
   • Select alert to gain visibility into sites that users are accessing. Traffic matching the category is allowed, and a URL filtering log is generated.
   • Select block to deny access to traffic that matches the category and log this traffic.
   • Select continue to display a response page to users that requires them to click Continue to proceed to a site in the category.
   • To only allow access if users provide a configured password, select override. For more details, see Allow Password Access to Certain Sites.
3. Detect corporate credential submissions to websites in allowed URL categories.

   To ensure the best performance and a low false positive rate, the firewall automatically skips checking the credential submissions for any App-ID™ associated with sites that have never been observed hosting malware or phishing content—even if you enable checks in the corresponding category. The list of sites for which the firewall skips credential checking is automatically updated through Applications and Threats content updates.

   1. In the URL Filtering profile, select the User Credential Detection tab.
   2. Select one of the methods to check for corporate credential submissions to web pages from the User Credential Detection drop-down:

      • Use IP User Mapping—Checks for valid corporate username submissions and verifies that the username matches the user logged in to the source IP address of the session. The firewall matches the submitted username against its IP address-to-username mapping table. You can use any of the user mapping methods described in Map IP Addresses to Users.
      • Use Domain Credential Filter—Checks for valid corporate usernames and password submissions and verifies that the username maps to the IP address of the logged-in user. See Configure Credential Detection with the Windows-based User-ID Agent for instructions on how to set up User-ID to enable this method.
      • Use Group Mapping—Checks for valid username submissions based on the user-to-group mapping table populated when you configure the firewall to map users to groups.
        With group mapping, you can apply credential detection to any part of the directory or to a specific group, such as groups like IT that have access to your most sensitive applications.

      This method is prone to false positives in environments that do not have uniquely structured usernames, so you should only use this method to protect your high-value user accounts.
   3. Set the Valid Username Detected Log Severity that the firewall uses to log detection of corporate credential submissions (default is medium).
4. Detect phishing and malicious JavaScript in real-time using local inline categorization.
5. Allow or block users from submitting corporate credentials to sites based on URL category to prevent credential phishing.

   To ensure the best performance and a low false positive rate, the firewall automatically skips checking the credential submissions for any App-ID associated with sites that have never been observed hosting malware or phishing content—even if you enable checks in the corresponding category. The list of sites for which the firewall skips credential checking is automatically updated through Applications and Threats content updates.

   1. For each URL category to which you allow Site Access, select how you want to treat User Credential Submissions:

      • alert—Allow users to submit credentials to the website but generate a URL filtering log each time a user submits credentials to sites in this URL category.
      • allow (default)—Allow users to submit credentials to the website.
      • block—Displays the anti-phishing block page to block users from submitting credentials to the website.
      • continue—Present the anti-phishing continue page, which requires users to click Continue to access the site.
   2. Configure the URL Filtering profile to detect corporate credential submissions to websites in allowed URL categories.
6. Define URL category exceptions to specify websites that should always be blocked or allowed, regardless of URL category.

   For example, to reduce URL filtering logs, you may want to add your corporate websites to the allow list so that no logs are generated for those sites or, if there is a website that is being overly used and is not work-related, you can add that site to the block list.

   The policy actions configured for custom URL categories have priority enforcement over matching URLs in external dynamic lists.

   Traffic to websites in the block list is always blocked regardless of the action for the associated category and traffic to URLs in the allow list is always allowed.

   For more information on the proper format and wildcard usage, review the URL Category Exception Guidelines.
7. Enable Safe Search Enforcement.
8. Log only the page a user visits for URL filtering events.

   1. Select URL Filtering Settings and enable Log container page only (default) so that the firewall logs only the main page that matches the category, not subsequent pages or categories that load within the container page.
   2. To enable logging for all pages and categories, disable the Log container page only option.
9. Enable HTTP Header Logging for one or more of the supported HTTP header fields.

   Select URL Filtering Settings and select one or more of the following fields to log:

   • User-Agent
   • Referer
   • X-Forwarded-For
10. Save the URL Filtering profile.

    Click OK.
11. Apply the URL Filtering profile to Security policy rules that allow traffic from clients in the trust zone to the Internet.

    Make sure the Source Zone in the Security policy rules to which you add URL Filtering profiles is set to a protected internal network.

    1. Select PoliciesSecurity. Then, select a Security policy rule to modify.
    2. On the Actions tab, edit the Profile Setting.
    3. For Profile Type, select Profiles. A list of profiles appears.
    4. For URL Filtering profile, select the profile you just created.
    5. Click OK to save your changes.
12. Commit the configuration.
13. Test your URL filtering configuration.
14. (Best Practice) Enable Hold client request for category lookup to block client requests while the firewall performs URL category lookups.

    1. Select DeviceSetupContent-ID.
    2. Select Hold client request for category lookup.
    3. Commit your changes.
15. Set the amount of time, in seconds, before a URL category lookup times out.

    1. Select DeviceSetupContent-IDgear icon.
    2. Enter a number for Category lookup timeout (sec).
    3. Click OK.
    4. Commit your changes.