topic Re: Blocked traffic log has no url logged in General Topics

Blocked traffic log has no url logged

SThatipelly — Fri, 07 Sep 2018 20:38:30 GMT

I want to look at the url address of a data packet that was blocked by a deny rule. I had url filtering applied on the rule but the denied traffic log shows the url category but not the url address. Please advise me in logging url address for denied traffic.

TIA

Re: Blocked traffic log has no url logged

BPry — Fri, 07 Sep 2018 20:57:59 GMT

@SThatipelly,

In all likelyhood you are blocking this traffic before the firewall would ever look at the URL, and therefore there is no reason to record this information.

Say for instance I've blocked access to 54.225.121.9. The URL of that IP is never recorded because the firewall never looks at it, because it knows that it needs to block the traffic before it ever needs to look at the URl.

Re: Blocked traffic log has no url logged

SThatipelly — Sat, 08 Sep 2018 00:25:01 GMT

@BPryhow come it showes the url category?

Re: Blocked traffic log has no url logged

Remo — Mon, 10 Sep 2018 17:35:07 GMT

@SThatipelly

How does your securitd policy rule look like or more precisely: how did you configure URL filtering? Did you add an URL filtering security profile or you just added the categories directly to the rule?

Re: Blocked traffic log has no url logged

SThatipelly — Mon, 10 Sep 2018 17:20:05 GMT

I had the complete url filering applied under profiles in action tab.

Re: Blocked traffic log has no url logged

Remo — Mon, 10 Sep 2018 17:46:48 GMT

@SThatipelly

Did you check the "URL Log" or opened the detail of such a denied session in the traffic log?

Re: Blocked traffic log has no url logged

zji — Tue, 21 Feb 2023 02:39:38 GMT

Sorry to bother you, may I ask did you figure out why the denied traffic log shows the url category but not the url address? Since my customer faced the same issue, there are only custom url category defined in the security rule and the action is deny.

Re: Blocked traffic log has no url logged

rt839134 — Mon, 22 May 2023 21:26:25 GMT

Were you ever able to figure this out? I have the same question

Re: Blocked traffic log has no url logged

Remo — Sun, 27 Aug 2023 18:48:27 GMT

I think it depends on how the traffic is blocked. If you have an IP based drop rule, the firewall is not able to log the actual URL. With a drop rule with an URL added direcrly to the rule a log is written, at least in new PAN-OS versions, so maybe this was a bug in the past, that then no url log was written - or a new feature that was implemented.