The Palo Alto Networks firewall (PAN-OS) processes URL filtering matches in a specific order of precedence, where the first match wins. The system first checks the URL Filtering Profile overrides, starting with the Block List (explicitly denied URLs) and then the Allow Lists (explicitly permitted URLs). If no match is found in the overrides, the system proceeds to categorization. It checks Custom URL Categories first to enforce user-defined patterns, followed by External Dynamic Lists (EDL). Finally, if the URL is not found in the custom or dynamic lists, the firewall queries the PAN-DB database. To minimize latency, it first checks the local data plane cache (Downloaded PAN-DB File) before querying the PAN-DB Cloud service.

Palo Alto Networks Knowledge Base, "How to Create Custom URL Categories," Section: Overview.

Quote: "The Palo Alto Networks firewall will process the filter as follows: Block list, Allow list, Custom category, Pre-defined category."

URL: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClH5CAK

Palo Alto Networks Live Community (Knowledge Base), "Understanding URL Filtering Order / URL Filtering Precedence," Section: URL Filtering Order.

Quote: "Precedence is from the top down - First Match Wins: 1. Block list... 2. Allow list... 3. Custom Categories... 4. Cached (EDL)... 5. Pre-Defined Categories."

URL: https://live.paloaltonetworks.com/t5/general-topics/understanding-url-filtering-order-url-filtering-precedence/td-p/238682

Palo Alto Networks Tech Docs, "How Advanced URL Filtering Works," Section: URL Categorization.

Quote: "The firewall determines a website's URL category by comparing it to entries in 1) custom URL categories, 2) external dynamic lists (EDLs), and 3) predefined URL categories, in order of precedence."

URL: https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-basics/how-url-filtering-works

Palo Alto Networks Tech Docs, "URL Filtering Log Fields," Section: Threat/Content Name.

Context: Describes the distinction between local cache lookups and cloud lookups (PAN-DB Cloud) for performance.

URL: https://docs.paloaltonetworks.com/ngfw/administration/monitoring/use-syslog-for-monitoring/syslog-field-descriptions/url-filtering-log-fields