Option to Hold Web Requests During URL Category Lookup

Choose to block web requests while the firewall looks up the URL category.
Beginning with PAN-OS 8.1.10 (and PAN-OS 9.0.4), you have the flexibility to hold or allow initial web requests while the firewall checks the URL category for the destination websites.
When a user visits a website, a firewall with URL Filtering enabled checks its local cache of URL categories in an attempt to categorize the site. If the firewall doesn’t find the category for that URL in the cache, that firewall performs a lookup in PAN-DB (the Palo Alto Networks URL database). By default, the firewall allows the web requests to pass through during this cloud lookup and enforces policy as needed after the server responds.
However, you can now choose to hold web requests (the firewall blocks the request) until the firewall either finds the URL category or the lookup times out. If the lookup times out, the firewall considers the URL category
not-resolved.
Configure URL Filtering to hold web requests by following these steps:
  1. Enter the command to enable the feature:
    admin@PA-3060>
    set system setting ctd hold-client-request yes

Recommended For You