URLs

A URL object is a configuration element that

  • defines a single URL or IP address for use within access control policies, event searches, and Security Intelligence configurations,

  • can be used in multiple locations throughout the system's web interface to specify what traffic is filtered or monitored, and

  • provides distinct matching behavior compared to URL group objects, which define multiple URLs or addresses.

URL object configuration guidelines

Important

For best practices for using this and similar options in Security Intelligence configurations and for URL rules in access control and QoS policies, see Manual URL Filtering Options.

When creating URL objects, consider the following guidelines:

  • If the URL does not include a path (no / characters), the match is based only on the server’s hostname. If a path is included (one or more / characters), the entire URL string is used for a substring match.

  • A URL is considered a match if:

    • the string appears at the beginning of the URL,

    • the string follows a dot,

    • the string contains a dot at the beginning,

    • or the string follows the :// characters.

  • The system ignores the encryption protocol (HTTP or HTTPS). Blocking a website applies to both unless an application condition targets a specific protocol. Specify URLs without the protocol (use example.com, not http://example.com).

  • To match HTTPS traffic in access control rules, use the subject common name from the public key certificate. Do not include subdomain information. The subject common name in certificates may differ from the web site's domain (for example, youtube.com uses *.google.com). Use SSL Decryption policy to decrypt HTTPS traffic for consistent URL filtering results.

  • URL objects will not match HTTPS traffic if the browser resumes a TLS session, as certificate information may not be available, which can lead to inconsistent results.

  • When using URL objects as aliases in remote access VPN policies, ensure the URL is 128 characters or less.

  • Do not use manual URL filtering to block or allow individual web pages or parts of sites (that is, URL strings with / characters), as servers can be reorganized and pages moved to new paths.

URL object matching examples

For example, ign.com matches ign.com or www.ign.com, but not versign.com. Use example.com rather than http://example.com when specifying a URL object.