Quiz Entry - updated: 2026.07.14
How does URL Filtering with a custom URL category work, and what does the asterisk * wildcard do?
Build a list of patterns (*.meteo.ch, meteo.ch); FW matches the requested URL's hostname against the list; matching Security Rule action (Deny) fires.
Wildcard semantics on Palo Alto:
| Pattern | Matches |
|---|---|
meteo.ch |
exactly meteo.ch |
*.meteo.ch |
any subdomain: m.meteo.ch, api.meteo.ch, but NOT meteo.ch itself |
*meteo* |
substring match — also catches srf.ch/meteo paths? No — wildcard applies to host, not path |
Pitfalls: URL category matches the hostname, not the URL path. So www.srf.ch/meteo is not caught by a meteo category — its host is srf.ch. To filter by path you need URL Filtering profiles with full URL match or a content-aware feature.
Real-world example:
meteo.ch
blocked (exact)m.meteo.ch blocked (if *.meteo.chis in list)meteo.com
different domainwww.srf.ch/meteo host is srf.chwetter.ch different domain (and HTTP/3 makes it worse — see QUIC card)
Tip: "URL category = hostname filter, not URL filter." A common pitfall.
Go deeper:
Content-control software (Wikipedia) — how URL/hostname filtering classifies and blocks domains at the host level.