topic Re: URL Filtering Log shows FORWARD in General Topics

URL Filtering Log shows FORWARD

MRosloniec — Wed, 25 Jun 2014 15:55:48 GMT

Hey All -

I have several URL-Filtering logs that come through with a category of FORWARD. Everything else is blank (URL, From Zone, To Zone, etc.). Can anyone shed some light on what this means?

Thanks!

Matt

Re: URL Filtering Log shows FORWARD

ssharma — Wed, 25 Jun 2014 16:57:28 GMT

Hi Matt,

What is the URL vendor that you are using? Could you please attach the snapshot of one of the logs that you are seeing. Thank you.

Re: URL Filtering Log shows FORWARD

MRosloniec — Wed, 25 Jun 2014 19:22:47 GMT

We are using PAN-DB. And I stand corrected. Source and Destination addresses are present. I've attached a screenshot.

Re: URL Filtering Log shows FORWARD

ajbool — Wed, 25 Jun 2014 20:00:43 GMT

That image looks pretty broken - it seems to have the application in the "From Zone" column and the Source Country in the Application column! I wouldn't trust that output very much...

Re: URL Filtering Log shows FORWARD

ericgearhart — Wed, 25 Jun 2014 20:05:33 GMT

Maybe he named the zone on the firewall web-browsing? That would be kinda weird though

Re: URL Filtering Log shows FORWARD

dyang — Wed, 25 Jun 2014 20:06:13 GMT

matt.rosloniec@amway.com,

Are your logs from a device or from Panorama? Also, what version of PAN-OS are you running?

--Doris

Re: URL Filtering Log shows FORWARD

MRosloniec — Wed, 25 Jun 2014 20:06:31 GMT

Well of course I don't trust the output, lol.. that's the purpose of the question. Regardless of how accurate the output is, it is showing up in our logs and I'd love to find out what it is.

Re: URL Filtering Log shows FORWARD

MRosloniec — Wed, 25 Jun 2014 20:07:25 GMT

Doris - Those logs are from a device, which forwards all log to an M-100 Log Collector. That being said, the screenshot was taken from Panorama.

Re: URL Filtering Log shows FORWARD

ajbool — Wed, 25 Jun 2014 20:09:23 GMT

Your firewalls are effectively providing you corrupted data. Personally, I'd resolve that first and then go from there...

If you look on the CLI; do you get the same output?

Re: URL Filtering Log shows FORWARD

dyang — Wed, 25 Jun 2014 20:10:32 GMT

Do you know if the logs are displayed correctly on the device? Also, what version of PAN-OS is running on Panorama? I know that there was a similar bug that was fixed, so I'm curious as to whether or not this is the same issue or another variant of it.

--Doris

Re: URL Filtering Log shows FORWARD

ajbool — Wed, 25 Jun 2014 20:11:10 GMT

I thought that at first; but then you see the Application column and you know its just fundamentally broken.

Re: URL Filtering Log shows FORWARD

ericgearhart — Wed, 25 Jun 2014 20:54:53 GMT

Oh yea wow, gotcha.

What the heck PANOS is this? I'm avoiding the 6.0 train for about a year on my side

Re: URL Filtering Log shows FORWARD

MRosloniec — Thu, 26 Jun 2014 13:11:49 GMT

dyang, ajbool, ericgearhart -

The device (Firewall) is running 5.0.11. The Log Collector it sends logs to is 5.1.3, and Panorama is 5.1.6.

Also, yes the logs appear correctly on the device. I took the query I ran in Panorama to get those results, and ran it on the device, and had correct results on the device.

Re: URL Filtering Log shows FORWARD

dyang — Thu, 26 Jun 2014 18:34:34 GMT

Hi matt.rosloniec@amway.com,

We had a bug where headers and the rest of the table did not match in certain scenarios, but that was only for CSV exports (this bug was also fixed in PAN-OS 6.0.1). Can you open a case with Support so we can take a look and investigate further?

Thanks,

Doris

Re: URL Filtering Log shows FORWARD

MRosloniec — Thu, 26 Jun 2014 18:43:08 GMT

dyang

Thanks, I will open a ticket with Support.