URL filtering profile alerts on or allows a high-risk category
At a glance
Base severity
Area
Platform
Evidence level
Benchmark reference
Reads the export, not the device
ConfigProof reads a configuration export. This control is evaluated against the objects in that file, and it reports what the file says. It does not connect to the device and sees no traffic, so a finding here describes the configuration, not what the firewall is doing right now.
Why it matters
A category in the alert list is permitted and logged, and a category in the allow list is permitted without a log entry. For categories whose content is the threat, such as command-and-control and malware, the configuration lets the session reach the site and records it afterwards.
How to fix it
Web interface
The steps below are written for the web interface. A finding raised on your own export carries the same steps with your object names filled in.
- Move these categories into the profile's block list.
- Where a category is alerted on purpose, record the decision so the next assessment reads it as a choice rather than a gap.
- Check the profile that covers outbound web traffic first: it is the one where these categories carry the most weight.
Command line
PAN-OS CLI, standalone firewall, vsys1
set vsys vsys1 profiles url-filtering <profile> block <category>delete vsys vsys1 profiles url-filtering <profile> alert <category>delete vsys vsys1 profiles url-filtering <profile> allow <category>
An example. Values in angle brackets are yours to supply; a finding on your own export fills in the names it read. Nothing here commits. Review the candidate configuration, then commit it yourself.
Read it back
show vsys vsys1 profiles url-filtering <profile>Values to fill in2
- <profile>
- Which profile to change. A firewall carries several of each kind.
- <category>
- One URL category, as it appears in the profile's lists.
Before you type it2
- One category per line. A category sits in only one of block, alert and allow, so the delete lines are what move it.
- Blocking a category changes what people can reach. Agree the list before you commit.
How to confirm the fix
- Reopen the profile and confirm each category named above sits in the block list.
- Confirm the rules using this profile are the ones intended to carry general web traffic.
Limits
- A URL filtering profile applies only where a rule attaches it. The count of rules using it is a separate question.
- The categories treated as high risk are a ConfigProof list of PAN-OS categories whose content is the threat rather than the subject matter. An organization that alerts on one of them on purpose is making a choice, not a mistake.
Compliance references
No benchmark recommendation is mapped to this control in this version.
More in Security Profiles
- PAN-SEC-011Inbound internet rule without threat prevention
- PAN-SEC-012Outbound internet rule without URL filtering
- PAN-SEC-013Allow rule without WildFire analysis
- PAN-SEC-043Profile group is missing part of the recommended baseline
- PAN-SEC-086WildFire analysis profile forwards a narrowed set of file types or one direction
- PAN-SEC-087Anti-spyware profile has DNS lists and nothing set to sinkhole
- PAN-SEC-088Anti-spyware profile sinkholes DNS queries to no address
- PAN-SEC-099Vulnerability protection profile does not block critical or high severity
See it on your own firewall
One complete analysis of one firewall costs nothing. A card is required and nothing is charged.