topic Re: Generated traffic logs showing weird information in General Topics

Generated traffic logs showing weird information

inderjit21 — Thu, 28 Oct 2021 23:52:35 GMT

I have a VM-500 panos-8.1.18. I am seeing traffic logs with below flags

Session End Reason- policy-deny (means traffic denied as per policy)

Action -Allow ( how can action be allowed when traffic is denied via policy)

Type- deny

We also have ssl decryption enabled.

Re: Generated traffic logs showing weird information

PavelK — Fri, 29 Oct 2021 00:33:28 GMT

Thank you for posting question @inderjit21

I have seen the same in Traffic logs: ( session_end_reason eq policy-deny ) and ( action eq allow ) in the case when security policy had an action: Allow however this policy had an URL Filtering Profile with Site Access: Block.

Is the policy you are seeing in the log using any URL filtering?

Kind Regards

Pavel

Re: Generated traffic logs showing weird information

inderjit21 — Fri, 29 Oct 2021 01:36:53 GMT

Yes it has url profile but there is no block under url profile just under traffic logs.

Re: Generated traffic logs showing weird information

PavelK — Fri, 29 Oct 2021 07:38:45 GMT

Thank you for reply @inderjit21

When you click on Log Detailed View icon on far left side:

does it reveal more details in the bottom section for the reason of the deny?

Also, could you check in Traffic log: ( session_end_reason eq decrypt-error ) or ( session_end_reason eq decrypt-unsupport-param) for any decryption errors related to this traffic?

Kind Regards

Pavel