In URL Filtering logs, URLs are not showing the subdomains. Showing upto ( .com/ )

ram.balaji — Tue, 21 Nov 2023 15:09:11 GMT

Hi Team,

In Strata Cloud Manager while seeing the URL filtering logs I am not able to see the subdomain URLs.

But in another tenant, I could see the complete logs after ( .com/ )

Eg: live.paloaltonetworks.com/t5/forums/postpage/board-id/Prisma_Access_Cloud_Management_Discussio

regards,

Akash Thangavel

Network Security Engineer

Re: In URL Filtering logs, URLs are not showing the subdomains. Showing upto ( .com/ )

aleksandar.astardzhiev — Thu, 21 Dec 2023 11:08:27 GMT

Hi @ram.balaji ,

The most plausible reason is that no SSL decryption is applied on the firewall generating these logs.

Without TLS/SSL decryption, PAN firewall is inspecting the SNI (server name indicator), from the SSL negotiation. This is sent by the client to the sever to indicate which host the client is trying to reach so the server can know which SSL certificate to provide (if the server host multiple sites).

Because traffic is encrypted and no decryption is applied FW cannot see the full URL from the HTTP headers and will use the SNI for web filtering categorization.

topic Re: In URL Filtering logs, URLs are not showing the subdomains. Showing upto ( .com/ ) in Prisma Access Cloud Management Discussions

In URL Filtering logs, URLs are not showing the subdomains. Showing upto ( .com/ )

Re: In URL Filtering logs, URLs are not showing the subdomains. Showing upto ( .com/ )