topic Allowed sites not loading correctly in General Topics

Allowed sites not loading correctly

rommel-madix — Wed, 11 Jan 2023 15:13:04 GMT

I am new to Palo Alto Firewalls so I am trying to figure this out. In our policy we have facebook allowed and it is not displaying the whole page. Am I missing something?

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

Re: Allowed sites not loading correctly

Raido_Rattameister — Wed, 11 Jan 2023 16:17:33 GMT

Assuming workstation IP is 1.2.3.4

Go to Monitor > Traffic and use filter below

( addr.src in 1.2.3.4 ) and (( action neq allow ) or ( session_end_reason eq threat ))

Also check Monitor > URL Filtering with following filter

( addr.src in 1.2.3.4 ) and ( action neq alert )

Do you see anything being blocked?

Re: Allowed sites not loading correctly

rommel-madix — Wed, 11 Jan 2023 16:24:14 GMT

Nothing blocked

Re: Allowed sites not loading correctly

BPry — Wed, 11 Jan 2023 22:05:53 GMT

@rommel-madix,

Assuming that things are default and you don't have a catch-all rule with logging enabled or logging enabled on the interzone-default rule, I'd recommend temporarily overriding the interzone-default entry to log at session end and verify that you're actually allowing all of the necessary traffic.

Keep in mind when dealing with URL categories as match criteria, by default you won't receive URL logs from your clients unless they're assigned a URL Filtering profile that has every single category set to at least 'alert' or higher.

Re: Allowed sites not loading correctly

Adrian_Jensen — Thu, 12 Jan 2023 17:51:10 GMT

In addition to what @BPry said about enabling logging on the default interzone deny rule, open up Chrome and turn on Developer Tools. Then navigate to the Facebook page and look in the Developer Tools network tab and look for 400/500 status errors. That will give you an idea of which elements of the page may be blocked. "Facebook" is a collection includes from a lot of different domains (facebook.com, facebook.net, fb.com, fbcdn.net, etc.) and third party domains.