topic Re: PA Web Proxy has more than syslog / logs on current PA FW in Web Proxy Discussions

PA Web Proxy has more than syslog / logs on current PA FW

Kakada_Sao16 — Fri, 07 Feb 2025 03:38:54 GMT

Dear PA team,

PA Firewall and PA Web proxy are integration with SIEM.

Before:

When my PC run though connecting on PA firewall has only 1 log ( End Traffic , Deny Access, Permit...) for each session.

Example:

1. Traffic End -> Feb 2, 2025, 10:15:00 AM

Now:

When my PC point connectivity to PA Proxy there have 2 or more for each session.

Example: Duplicate logs

1. Traffic End -> Feb 2, 2025, 10:15:00 AM

2. Traffic End -> Feb 2, 2025, 10:15:00 AM

On Proxy where Security Policy we defined Allow User to proxy and Allow Proxy to Internet.

We concern with SIEM consumption resource performance and licensing cost. When has more logs on PA Web proxy.

Do we have solution to fix this case? To ensure it has as same as log on PA FW for each session.

Thanks,

Re: PA Web Proxy has more than syslog / logs on current PA FW

nikoolayy1 — Tue, 25 Feb 2025 11:49:37 GMT

Hey @Kakada_Sao16 , Please keep in mind that this is a tech forum and most of solutions come from not directly working professionals for Palo Alto that assist each other in the best way possible. What you have seems like a design issue as having a rule for Proxy To Internet seems strange as you are allowing your PA firewall/Proxy to talk to Internet as a user for me if going to internet should match 1 rule if allowed/blocked based better on a AD group 🤔 The only way to match 2 rules for me if you have the so called proxy to internet rule before the client rule and there to be the so called "appshift" as maybe the first rules matches all web browser traffic and then the application gets detected which is bad design How to Prevent Application Shift - Knowledge Base - Palo Alto Networks

I suggest involving Palo Alto Professional Services (PS) or a partner company as this will also probably be outside the scope of the Palo Alto Support TAC team to assist you with.

Re: PA Web Proxy has more than syslog / logs on current PA FW

Kakada_Sao16 — Fri, 21 Mar 2025 01:32:01 GMT

Hello @nikoolayy1

let us further check with them. thanks.