Create a Custom URL Category for Cloud NGFW on AWS
Table of Contents
Expand all | Collapse all
-
- About Cloud NGFW for AWS
- Getting Started from the AWS Marketplace
- Cloud NGFW for AWS Pricing
- Cloud NGFW for AWS Free Trial
- Cloud NGFW for AWS Limits and Quotas
- Subscribe to Cloud NGFW for AWS
- Cross-Account Role CFT Permissions for Cloud NGFW
- Invite Users to Cloud NGFW for AWS
- Manage Cloud NGFW for AWS Users
- Deploy Cloud NGFW for AWS with the AWS Firewall Manager
- Enable Programmatic Access
- Terraform Support for Cloud NGFW AWS
- Provision Cloud NGFW Resources to your AWS CFT
- Usage Explorer
Create a Custom URL Category for Cloud NGFW on AWS
Palo Alto Networks provides a set of predefined
URL filtering categories. You can also specify your own URL filtering
categories using a customer URL category object. For example, create
a custom list of URLs that you want to use as match criteria in
a Security policy rule. This is a good way to specify exceptions
to URL categories, where you’d like to enforce specific URLs differently
than the URL category to which they belong.
Create a Custom URL Category
- SelectRulestacksand select a previously-created rulestack on which to configure a custom URL category.
- Select.ObjectsCustom URL CategoryCreate Custom URL Category
- Enter a descriptiveNamefor your custom URL category.
- (optional) Enter a description for your custom URL category.
- Enter one or moreURL List, one per line.
- ClickSave.
Basic Guidelines For URL Category Exception Lists
- Enter the URLs of websites that you want to enforce separately from the associated URL category.
- List entries must be an exact match and are case-insensitive.
- Enter a string that is an exact match to the website (and possibly, specific subdomain) for which you want to control access, or use wildcard characters to allow an entry to match to multiple website subdomains. For details on using wildcard characters, review Wildcard Guidelines for URL Category Exception Lists.
- Omithttpandhttpsfrom URL entries.
- Each URL entry can be up to 255 characters in length.
Wildcard Guidelines for URL Category Exception Lists
You can use wildcards in URL category exception lists
to easily configure a single entry to match to multiple website
subdomains and pages, without having to specify exact subdomains
and pages.
Follow these guidelines when creating wildcard entries:
- The following characters are considered token separators: . / ? & = ; +Every string separated by one or two of these characters is a token. Use wildcard characters as token placeholders, indicating that a specific token can contain any value.
- In place of a token, use either an asterisk (*) or a caret (^) to indicate a wildcard value.
- Wildcard characters must be the only character within a token. For example, www.gmail*.com would be invalid because the asterisk follows other characters. An entry can contain multiple wildcards, however.
How to Use Asterisk (*) and Caret (^) Wildcards
* | Use to indicate one or more variable subdomains. If
you use * , the entry will match any additional subdomains,
whether at the beginning or the end of the URL.Ex:
|
^ | Use to indicate one variable subdomain. Ex: mail.^.com matches
to mail.company.com but not mail.company.sso.com. |
Do not create an
entry with consecutive asterisk (*) wildcards or more than nine consecutive
caret (^) wildcards—entries like these can affect firewall performance.
For
example, do not add an entry like
mail.*.*.com
;
instead, depending on the range of websites you want to control
access to, enter mail.*.com
or mail.^.^.com
.
An entry like mail.*.com
matches to a greater
number of sites than mail.^.^.com
; mail.*.com
matches
to sites with any number of subdomains and mail.^.^.com
matches
to sites with exactly two subdomains.URL Category Exception List—Wildcard Examples
The following table displays example URL list entries
using wildcards and sites matching these entries.
URL Exception List Entry | Matching Sites |
|---|---|
Example Set 1 | |
*.company.com | eng.tools.company.com support.tools.company.com tools.company.com docs.company.com |
^.company.com | tools.company.com docs.company.com |
^.^.company.com | eng.tools.company.com support.tools.company.com |
Example Set 2 | |
mail.google.* | mail.google.com mail.google.co.uk mail.google.example.org |
mail.google.^ | mail.google.com mail.google.info |
mail.google.^.^ | mail.google.co.uk mail.google.example.info |
Example Set 3 | |
site.*.com | site.yourname.com site.abc.xyz.com |
site.^.com | site.company.com site.example.com |
site.^.^.com | site.a.b.com |
site.com/* | site.com/photos site.com/blog/latest any
site.com subdirectory |