topic Re: Facebook not showing in logs in General Topics

Facebook not showing in logs

janelle.provine — Wed, 03 May 2023 19:44:07 GMT

What would cause facebook not to be shown in any of the logs on the PA?

Re: Facebook not showing in logs

BPry — Wed, 03 May 2023 21:34:41 GMT

Is it possible that you aren't logging the rule associated with the traffic? facebook-base is pretty easily identified on the firewall even if the traffic isn't being decrypted, so if you aren't seeing anything I'd assume that it either isn't being logged or nobody is actually visiting the site.

Re: Facebook not showing in logs

janelle.provine — Wed, 03 May 2023 21:45:05 GMT

@BPry what would keep the rule from logging the facebook traffic while on the VPN? How can I check? and yes I can see other people using it just not when they are on the VPN

Re: Facebook not showing in logs

BPry — Wed, 03 May 2023 22:01:32 GMT

@janelle.provine,

The matching rule would need to be configured to not log the traffic. You'd have to look at the rule that would allow Facebook traffic and ensure that it's setup to log properly. You can test the traffic against your rulebase using the 'Test Security Policy Match' feature in the GUI from your Security policies page, or use the 'test security-policy-match' command via the CLI.

There should be no reason outside of the matching policy being set to not log that specifically Facebook wouldn't show up in your traffic logs.

Re: Facebook not showing in logs

janelle.provine — Thu, 04 May 2023 13:47:59 GMT

@BPry

Yes logging is turned on for all the security rules, and it is logging for those on the internal network but not for those on the VPN

Re: Facebook not showing in logs

BPry — Thu, 04 May 2023 20:42:23 GMT

@janelle.provine,

If the security policy is setup to log and it's not logging Facebook, and it's only happening on VPN traffic, are you potentially sending the traffic out locally? I'd review that you don't have anything configured in GlobalProtect's agent config to only send internal routes through GlobalProtect or have otherwise excluded the Facebook domains as an excluded domain.

Re: Facebook not showing in logs

janelle.provine — Thu, 04 May 2023 20:48:33 GMT

I have split tunneling turned off so all of the users traffic routes through the internal network including his internet access.

Re: Facebook not showing in logs

janelle.provine — Fri, 05 May 2023 15:30:37 GMT

I figured out that the issue is caused by the fact that we are using duo mfa and the user in duo mfa is different from what is in the AD user group applied to the rule so that is why any user works and I was looking for the wrong user in the log so that is why I did not see it. I added a alias in duo that matches the AD usersname but it still didn't work, Any idea