topic Setup Alert for Traffic to Specific IPs in General Topics

Setup Alert for Traffic to Specific IPs

mario11584 — Thu, 03 Oct 2013 22:38:37 GMT

We are trying to figure out if there is a way to have the firewall create an alert in the logs when traffic hits a specific IP range. We don't want to block access to this range of IP addresses but we want to be able to confirm if users are conversing with IPs in a specific range. Any thoughts on this would be appreciated?

Thanks in advance!

Re: Setup Alert for Traffic to Specific IPs

ukhapre — Fri, 04 Oct 2013 01:47:28 GMT

Hi,

Yes. You need to specify separate rule for the traffic pertaining to IP range.

e.g. see below rule for source range 10.0.0.0/8

Setup email, log forwarding profile and assign it to the the relevant security rule.

For detailed steps to create email, log forwarding profile refer to https://live.paloaltonetworks.com/docs/DOC-3779

Hope this helps!