> For the complete documentation index, see [llms.txt](https://docs.colt.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.colt.net/product/sd-wan-versa/use-cases/url-filtering-1.md). # SETTING UP URL FILTERING IN THE SD WAN FIREWALL This use case shows the steps you need to take to complete a rule for URL filtering on an SD WAN brand template. {% hint style="info" %} Note: Subscription to the Colt SD WAN Advanced Security package is required to access the firewall features {% endhint %} #### OVERVIEW Configuring your firewall with the URL filtering feature lets you manage your users’ internet access. URL filtering prevents users from accessing sites your organization deems unproductive; enables secure web access; and protects from sophisticated threats, including malware and phishing sites. URL filtering uses local databases to associate the URL with the category and reputation for a comprehensive screening process. #### WHAT YOU NEED TO KNOW ABOUT URL FILTERING * URL filtering provides rich and flexible filtering solutions for web traffic. * More than 450 million URLs are categorised and are continually updated. * Each URL is looked up in the local database, so the URL is associated with a URL category and URL reputation. * Restricts access to websites you choose based on the URL category and/or URL reputation. * Enforce policy actions for websites based on blacklists and whitelists of URLs. #### PRE-DEFINED URL REPUTATIONS SD WAN supports the following types of pre-defined URL reputations. You can also create your own user defined reputations. Values are assigned to each URL, the lower the value, the higher the reputation. * Trustworthy * Low risk * Moderate risk * Suspicious * High risk * Undefined #### URL FILTERING ACTIONS * Allow—the URL can be viewed without generating an entry log. * Drop-packet—the browser waits for a response from the server and drops the packets. There is no way to differentiate if this is due to the delayed response from the server or if the firewall blocks access to the website. * Drop-session—the browser waits for a response from the server and drops the session. There is no way to differentiate if this is due to the delayed response from the server or if the firewall blocks access to the website. * Alert—allows the URL and generates a log entry in the URL filtering log. * Reject—the browser displays an alert and resets the connection to the server. There is no way to differentiate if this is due to the delayed response from the server or if the firewall resets access to the website. * Block—the URL is blocked. Users will not see a response page and cannot continue with the website. This also generates a log in the URL filtering log. * Ask—the browser presents an information page that allows users to either cancel the operation by clicking Cancel or continue with the operation after clicking OK for http/https. * Inform—the browser presents an information page that allows users to continue after clicking OK for http/https. * Justify—the browser presents an information page that allows users to either cancel the operation by clicking Cancel or continue with the operation after entering a justification message and clicking OK for http/https. * Override—specifies that a password is required to allow access to the website in the category. This generates an entry in the URL filtering log. In the example use case below, we will: * Review and set up a URL filtering profile (Task 1). * Demo where to find white list, black list, category, and reputation settings. * Review and set up a rule to enforce the URL filtering built in the profile (Task 2). {% hint style="info" %} Note: Colt may have already defined some standard security settings as originally requested in the initial deployment. Before making additional changes, be sure to review your existing settings. {% endhint %} ### TASK 1 - CONFIGURING A URL FILTERING PROFILE 1. Log in to the SD WAN portal. 2. In the Director Context, click the Config Templates tab. 3. In the Services tab (shown with the gear icon), select Next Gen Firewall > Security > Profiles > URL Filtering. 4. From the Organization list, select an entity. 5. Verify the correct template is selected in the template list in the upper left of the window. 6. Click the + sign to add a new URL filter.
7. In this use case, we describe how to fill out the fields and show options for completing the profile. These selections are used as an example and may not apply to your setup. * In the **Name** field, type a name for the URL filter. *We named ours Guest\_URL\_Filtering.* * In the **Description** field, type a description that explains the purpose of the URL filter. * In the **Tags** field, type keywords or phrases that allow you to filter the URL. This is useful when you have many policies. * From the **Default Action** list, select a default action you want to impose on the URL filter. *In most cases you’ll use allow or block, in this case we selected block.* * From the **Cloud Lookup Mode** list, select the cloud lookup mode for searching the URL filter classification over cloud. *We selected never.* You can select from these options: * No predefined matches—cloud lookup is performed only when the URL does not match any predefined URL category. * No user defined matches—cloud lookup is performed only when the URL does not match any user-defined URL category. * No pre user defined matches—cloud lookup is done only when the URL does not match any predefined URL category. * Always—perform a cloud lookup for this profile. * Never—do not perform a cloud lookup for this profile.
8. From the **LEF Profile** list, select an LEF profile to register logs for this filter.
9. Click the **Blacklist** tab: 1. From the **Action** list, select a URL action when you encounter a blacklisted URL. 2. In the **Pattern** section, click the **+ sign** to block specific URLs. You can specify a fixed string or a regex pattern to match the blacklisted URL. 3. In the **Strings** section, click the **+ sign** to specify the complete URL string you want to block. *We blocked [www.youtube.com](http://www.youtube.com).*
10. Click **OK**.
11. Click the **Whitelist** tab: 1. Select the **Enable Logging** checkbox to enable logging the whitelist configuration. 2. In the **Pattern** section, click the **+ sign** to allow specific URLs. You can specify a fixed string or a regex pattern to match the whitelisted URL. 3. In the **Strings** section, click the **+ sign** to specify the complete URL string that you want to allow. *We allowed [www.google.com](http://www.google.com).* 12. Click **OK**.
13. Click the **+ sign** to add a category-based action.
14. Fill in the information for category-based actions: 1. In the **Name** field, type a name for the category-based action. *We named ours BlockedCategories.* 2. From the **Action** list, select a URL action. *We selected block*. 3. In the **Predefined Categories** section, click the + sign to select from a list of predefined categories. *We selected gambling.* 4. In the **User-defined Categories** section, click the + sign to select from the list of user defined categories. 15. Click **OK**. 16. In the **Reputation Based Action** tab: 1. Click the **+ sign** to add reputation-based actions.
17. Fill in the information for reputation-based actions: 1. In the **Name** field, type a name for the reputation-based action. *We named ours Sample.* 2. From the **Action** list, select a URL action when you encounter a URL in this reputation. *We selected reject.* 3. In the **Predefined Reputations** section, click the + sign to select from a list of predefined reputations. *We selected high-risk.* 18. Click **OK**, then click **OK** again. ### TASK 2 - CONFIGURING SECURITY POLICIES 1. In the Director Context, click the **Config Templates** tab. 2. In the **Services** tab (shown with a gear icon), select **Next Gen Firewall > Security > Policies > Rules**. 3. From the **Organization** list, select an entity. Be sure you select the correct template list in the upper left of the window. 4. Click the **+ sign** to add a new security policy, known as a rule. {% hint style="info" %} **Note:** Colt has created a default policy for you during the initial setup {% endhint %}
In this use case, we describe how to fill out the fields and show options for completing the profile.
5. Fill in the information to add a rule: 1. In the **Name** field, type a name for the policy rule. *We named ours Guest\_URL\_Rule.* 2. In the **Description** field, type a description that explains the purpose of the URL filter. 3. In the **Tags** field, type keywords or phrases that allows you to filter rule. This is useful when you have many policies. 6. Click the **Enforce** tab. 1. In the **Actions** section, select a button for the action that applies to the rule. *We selected Apply Security Profile.* 2. In the **Profiles** section, select the checkbox next to URL-Filtering and select the URL filter from the list that you created in Task 1. *We selected Guest\_URL\_Filtering.* 3. In the **Log** section, select a button for events to log and the associated logging profile. *We selected Never.* 7. Click **OK**.\