topic Re: Bottom most Explicit deny all policy not capturing URLs for Url filtering logs. in Next-Generation Firewall Discussions

Bottom most Explicit deny all policy not capturing URLs for Url filtering logs.

JubairJunaid — Wed, 21 May 2025 10:13:14 GMT

So we have a URL filtering profile, which when enabled i can see URL filtering logs for a any any test policy, however there is a Deny All policy we created at the bottom most in policy, I have enabled URL filtering profile for that rule. I am seeing normal network traffic but not any log under Monitor > URL filtering.

Yes we do have URL filtering license, just so you now its working for a test rule where its allowed for any to any and we applied url filtering profile.

Please advice how i can see the denied URL logs. Thanks

Re: Bottom most Explicit deny all policy not capturing URLs for Url filtering logs.

Raido_Rattameister — Wed, 21 May 2025 13:05:30 GMT

As Palo is dropping packets matching drop/deny rule it can't perform deep packet inspection for this traffic so you can as well not apply security profiles to this policy - they won't be used anyway.

Re: Bottom most Explicit deny all policy not capturing URLs for Url filtering logs.

Raido_Rattameister — Wed, 21 May 2025 13:09:26 GMT

Just apply URL filtering profile to your outgoing rule where categories you want to permit are set to "alert" and those you don't want to permit are set to "block".

Then you see blocked URL categories matching your general outgoing rule.

Re: Bottom most Explicit deny all policy not capturing URLs for Url filtering logs.

reaper — Thu, 22 May 2025 07:57:50 GMT

It's important to consider a web browsing session is handled by 2 different 'layers' in the palo alto firewall

first, your security rule will allow or deny a session to flow based on the 6-tuple (source/destination zone, IP, port, protocol). The security rule only looks at basic IP information

Then, a rule can be instructed to also perform layer7 (deep packet) inspection. This causes the firewall to inspect the traffic at a different level and look at, for example, which URL is being requested inside the flow

The URL filtering profile will then determine if a connection is allowed (allow or alert action) or denied (block action) for that specific URL

this results in any web browsing session to have 2 verdicts: allow for the 'traffic' (layer3/4) and alert/block for the content (layer7)

To build a good web browsing policy, you should make a rule that allows traffic from trust to untrust, and has a url filtering profile that is configured to allow and block certain URL categories

In your traffic log this rule will always be 'allow', in your url filtering log this rule will sometimes be 'alert' and sometimes 'block'

by default any security rule that is set to deny or drop, will discard a session at a very early stage (oftentimes already discarding the SYN packet) so there is no layer7 inspection performed on these sessions