still see in logs while I already blocked it

KmdCyber — Wed, 05 Oct 2022 06:35:54 GMT

Dears

panorama firewall logs show threat for example spyware which threat name is website link. I blocked website IP and the link but still I see it in logs.it repeated many times which full the logs .The source address from DMZ zone and the destination address from outside. what can I do to not see it again in logs ?

Re: still see in logs while I already blocked it

S.Cantwell — Fri, 07 Oct 2022 15:04:09 GMT

You should confirm that the Security Rule that is the blocking the site should be both the ip AND the fdqn for the site.
I would also make sure that this rule is above the existing rule(s) that is allowing the traffic. Maybe put this as rule 1 in your policy.
Outside of that, with a remote desktop session to actually see what is going on, to screen captures of your policies, this will be different to troubleshoot via the forum. Best to create a simple TAC web case and have an engineer look at your policies and assist you.

What other questions may I answer for you?

topic Re: still see in logs while I already blocked it in Next-Generation Firewall Discussions

still see in logs while I already blocked it

Re: still see in logs while I already blocked it