topic Re: Need clarification on URL Filtering logs in Next-Generation Firewall Discussions

Need clarification on URL Filtering logs

Arun_R — Tue, 16 Apr 2024 06:51:33 GMT

Hi everyone,

Please help me get through this.

We have configured PA-450 firewall and everything is working fine as expected.
But, We have used the option URL category in the security policy without an URL filtering profile for all user group. Which is working fine but I cant see any URL user activity report.
But we need block URL summary report.

Then I found out that we need block or alert action in order to get URL logs.

Current Scenario
=================
(Its not the real configuration setup from the firewall, just a prototype)

The above screenshot is the current scenario of the security policies which has URL category directly mapped in polices.
There are no Block URL user activity report generated.

Please observe the below workaround.

Workaround
============

Please observe the above screenshot.
Above we have all the URL category mapped allow policies which generates no logs.
What if I create a security policy with a URL profile which blocks all the category at the bottom.

All the allowed traffic will hit on the above rules for all user groups and other traffics will hit on the bottom block rule and generates the Block URL user activity summary ... right ?

Please correct me if I am wrong.

NOTE: We don't want to use URL Filtering Profile. Instead we need the carry on with current scenario.

Please help me with this doubt.

Thanks in advance 🙂

Re: Need clarification on URL Filtering logs

reaper — Tue, 16 Apr 2024 07:38:47 GMT

you'll need to set that 'block all' rule to allow since a deny rule will not put packets into l7 for inspection, so you wont hit the url filtering block action, and get no logs

Dare i ask why you're not using url filtering to allow url categories? 😉

Re: Need clarification on URL Filtering logs

Arun_R — Tue, 16 Apr 2024 08:58:36 GMT

Hi @reaper

Thank you for your reply,

So if we configure the last Block Rule and set all the predefined URL category to "Block" and rule as "Allow"

We will get the URL user activity summary right ?

Re: Need clarification on URL Filtering logs

reaper — Tue, 16 Apr 2024 13:54:28 GMT

correct

the log is generated from the url decoder action, which is only triggered if you let the 'base' traffic (tcp connection) pass which is achieved by setting the security rule to allow

Advantage of this approach is also that users will receive a nice block page in their browser versus a failed connection with no context