Generative AI tools are now part of daily work, and most organizations have to decide which of them people may use. Blocking a single website does not get you far: there are hundreds of AI services, new ones appear every week, and the one your company pays for still has to work. A Palo Alto Networks firewall can enforce that decision with features you probably already use. Here is how to block AI apps on Palo Alto firewall, allow the ones you approve, and where the firewall's control ends.
Why one blocked website is not enough
The obvious first step is to add a site like chatgpt.com to a custom URL category and block it. It works for that one service, but the list of AI tools grows faster than anyone can maintain it by hand, and users simply move to the next one.
A policy that holds up needs three things. It has to recognize AI apps as a group rather than by name, it has to pick up new ones without you editing rules, and it needs an exception for the AI tools your organization has approved. On a Palo Alto Networks firewall, App-ID provides the first two, and rule order provides the third.
Group AI apps with an application filter
App-ID identifies the application inside the traffic, whatever port it uses. Palo Alto Networks also labels applications with predefined tags, and generative AI services carry the Generative AI tag.
An application filter turns that tag into a policy object. Go to Objects > Application Filters, add a filter, and select the Generative AI tag. You can narrow the filter further, for example by risk score, if you only want to block the riskiest AI apps. Before you click OK, review the list of matching applications, so you know exactly what the filter covers on your firewall.
The real value of a filter is that it is dynamic. Palo Alto Networks delivers new App-IDs and their tags through content updates, and every new app with the Generative AI tag joins your filter automatically. You don't have to touch the rule when the next AI service appears.
Allow approved AI first, then block the rest
Security policy rules are evaluated from top to bottom, and the first match wins. That makes the exception easy. Put a rule that allows your approved AI app, such as the one your company licenses, above a rule that denies the Generative AI filter. If only certain teams should use it, add their User-ID groups to the allow rule as the source user.
Before you switch the deny rule on, find out what you are about to break. Create the rule with the filter but with the action set to Allow, then check Monitor > Logs > Traffic with the filter ( rule eq 'Block Generative AI' ), using your own rule name. After a few days, you know which AI apps people actually use and who uses them. Then decide what to approve, and change the action to Deny.
Catch new AI sites with URL Filtering
App-ID only recognizes an application once Palo Alto Networks has released an App-ID for it. A new AI site can be in use well before that. URL Filtering covers the gap, because it categorizes the website itself, whether or not an App-ID exists for it yet.
Advanced URL Filtering used to have one broad Artificial Intelligence category. It is now split into granular categories by what the site does, such as AI Conversational Assistant, AI Code Assistant, AI Writing Assistant, and AI Meeting Assistant. New AI sites are no longer added to the broad parent category, so a profile that blocks only that category slowly stops catching anything new. Use the granular categories instead.
Two details matter when you set this up:
- A site is categorized as AI only if it actually offers an AI tool. chatgpt.com is an AI Conversational Assistant, while openai.com, the company's information site, is not.
- In the default URL Filtering profile, the granular AI categories only alert. To block them, set their action to block in your own profile.
Attach that profile to your general web access rule, not to the rule that allows your approved AI app. The first matching rule decides which profile applies, so the approved app keeps working while everything else in those categories is blocked.
Decrypt, or the firewall sees only the hostname
Almost all AI services run over HTTPS. Without decryption, the firewall sees which server a client connects to, but not what happens inside the connection. URL Filtering then works on the hostname alone, and many applications can't be told apart, so their traffic may show up only as ssl.
Applipedia, Palo Alto Networks' application database, lists for every App-ID whether it Requires Decryption. Check that field for the AI apps you want to control. If they need it, your Decryption policy has to cover that traffic, or the deny rule simply won't match.
Where the firewall stops
Everything above decides which AI apps people can reach. It doesn't decide what they type into the apps you allow. If the real worry is someone pasting customer data or source code into an approved assistant, you need content inspection on top of access control.
Palo Alto Networks offers this as a separate subscription. AI Access Security uses Enterprise DLP (Data Loss Prevention) to inspect traffic to supported AI apps and stop sensitive data from leaving, and it works on next-generation firewalls and Prisma Access. It needs its own license, so treat it as the next step once the access policy is in place, not a replacement for it.
Conclusion
To block AI apps on Palo Alto firewall without blocking the AI tools your company relies on, combine features that are already on the firewall. An application filter with the Generative AI tag catches known AI apps and grows with every content update. A rule above it allows the approved app for the right users. The granular AI URL categories catch new AI sites before they have an App-ID, and decryption makes sure the firewall can actually see the traffic. Test with an allow action first, read the logs, and then enforce.
If you also run FortiGate firewalls, the same approach is covered in our post Block AI Apps on FortiGate.
Relevant Training
Security policy, App-ID, and User-ID are covered in Palo Alto Networks Firewall Traffic Control, and decryption in Palo Alto Networks Firewall Advanced Traffic Control, both with hands-on Virtual Labs.
0 Comments