>
    Policy Actions You Can Take Based on URL Categories
    Focus
    Download PDF
    Focus
    1. Home
    2. PAN-OS
    3. URL Filtering
    4. URL Categories
    5. Policy Actions You Can Take Based on URL Categories
    Download PDF

    Policy Actions You Can Take Based on URL Categories

    Table of Contents
    End-of-Life (EoL)

    Policy Actions You Can Take Based on URL Categories

    Learn about the actions you can enforce on websites matching the URL categories specified in URL Filtering profiles and policies.
    On the firewall, you can use a URL Filtering profile to specify how you would like to enforce URL categories. By default, site access for all URL categories is set to allow when you create a new URL Filtering profile. This means that the users will be able to browse to all sites freely and the traffic is not logged. Customize the URL Filtering profile by deciding what type of Site Access you want to enforce for each category. To prevent credential phishing, you can also allow or disallow User Credential Submissions based on URL category (for example, you can block user credential submissions to medium and high-risk sites). Users can still access these sites, but cannot enter submit their corporate credentials to them.
    To start enforcing the actions you’ve defined in a URL Filtering profile, you’ll need to attach the profile to a Security policy rule. The firewall enforces the profile actions on traffic that matches the Security policy rule (for details, see Configure URL Filtering).
    Learn more about configuring a best practice URL Filtering profile to ensure protection against URLs that have been observed hosting malware or exploitative content.
    Action
    Description
    Site Access
    alert
    The website is allowed and a log entry is generated in the URL filtering log.
    Set alert as the Action for categories of traffic you don’t block to log and provide visibility into the traffic.
    allow
    The website is allowed and no log entry is generated.
    Don’t set allow as the Action for categories of traffic you don’t block because you lose visibility into traffic you don’t log. Instead, set alert as the Action for categories of traffic you don’t block to log and provide visibility into the traffic.
    block
    The website is blocked and the user will see a response page and will not be able to continue to the website. A log entry is generated in the URL filtering log.
    Blocking site access for a URL category also sets User Credential Submissions for that URL category to block.
    continue
    The user will be prompted with a response page indicating that the site has been blocked due to company policy, but the user is prompted with the option to continue to the website. The continue action is typically used for categories that are considered benign and is used to improve the user experience by giving them the option to continue if they feel the site is incorrectly categorized. The response page message can be customized to contain details specific to your company. A log entry is generated in the URL filtering log.
    The Continue page doesn’t display properly on client systems configured to use a proxy server.
    override
    The user will see a response page indicating that a password is required to allow access to websites in the given category. With this option, the security admin or helpdesk person would provide a password granting temporary access to all websites in the given category. A log entry is generated in the URL filtering log. See Allow Password Access to Certain Sites.
    In earlier release versions, URL Filtering category overrides had priority enforcement ahead of custom URL categories. As part of the upgrade to PAN-OS 9.0, URL category overrides are converted to custom URL categories, and no longer receive priority enforcement over other custom URL categories. Instead of the action you defined for the category override in previous release versions, the new custom URL category is enforced by the Security policy rule with the strictest URL Filtering profile action. From most strict to least strict, possible URL Filtering profile actions are: block, override, continue, alert, and allow.
    This means that, if you had URL category overrides with the action allow, there’s a possibility the overrides might be blocked after they are converted to custom URL category in PAN-OS 9.0.
    The Override page doesn’t display properly on client systems configured to use a proxy server.
    none
    The none action only applies to custom URL categories. Select none to ensure that if multiple URL profiles exist, the custom category will not have any impact on other profiles. For example, if you have two URL profiles and the custom URL category is set to block in one profile, if you do not want the block action to apply to the other profile, you must set the action to none.
    Also, in order to delete a custom URL category, it must be set to none in any profile where it is used.
    User Credential Permissions
    These settings require you to first set up credential phishing prevention.
    alert
    Allow users to submit corporate credentials to sites in this URL category, but generate a URL Filtering alert log each time this occurs.
    allow (default)
    Allow users to submit corporate credentials to websites in this URL category.
    block
    Block users from submitting corporate credentials to websites in this category. A default anti-phishing response page is displayed to users when they access sites to which corporate credential submissions are blocked. You can choose to create a custom block page to display.
    continue
    Display a response page to users that prompts them to select Continue to access to access the site. By default, the Anti Phishing Continue Page is shown to user when they access sites to which credential submissions are discouraged. You can also choose to create a custom response page to display—for example, if you want to warn users against phishing attempts or reusing their credentials on other websites.

    © 2024 Palo Alto Networks, Inc. All rights reserved.