topic Re: Traffic Logs - Resolve Hostname - Micrsoft Public IPs in General Topics

Traffic Logs - Resolve Hostname - Micrsoft Public IPs

tpmeier — Thu, 29 Nov 2018 16:29:07 GMT

Dear Commuity,

I am very new to Palo Alto Firewalls. I saw, that you can check the "Resolve hostname" checkbox when viewing Traffic Logs. Sadly a lot of IPs are not being resolved. I examed a few random samples and notices, the IPs mostly belong to Microsoft.

I am now wondering, if there is some kind of way, that I could see this in Traffic Log directly. I dont necessarily need a hostname. I am happy if I would be able to display organization name behind the IP.

Regards,

Eve Meier

Re: Traffic Logs - Resolve Hostname - Micrsoft Public IPs

hshawn — Thu, 29 Nov 2018 16:38:17 GMT

That would be nice right? 😉 you will be annoyed and frustrated with AWS, Akamai, Azure, etc.. at least the google stuff all resolves as 1e100 so we know who that is but you really do not know who is behind the AWS/Azure/etc IPs without a little extra legwork. Typically what I will do is go to my Linux VM, pull up the IP in firefox->click add exception (because the cert will not match the IP)->click view cert and then just look at the certname. There may be other ways so if anyone else has tips and tricks for this I am going to watch this thread.

Re: Traffic Logs - Resolve Hostname - Micrsoft Public IPs

Raido_Rattameister — Thu, 29 Nov 2018 16:44:54 GMT

Open command prompt in Windows

ping www.google.com

In my case result was 172.217.3.68

But if you ping IP and try to resolve to name

ping -a 172.217.3.68

Result was mia07s54-in-f4.1e100.net

It is not something that Palo can do - it depends on what entry is in Reverse DNS zone for this IP.

Re: Traffic Logs - Resolve Hostname - Micrsoft Public IPs

tpmeier — Thu, 29 Nov 2018 16:59:06 GMT

Hi,

I understand what you mean. As mentioned hostname - even if it can be resolved - will often not be very helpfull in case of Microsoft, Google and others. Thats why I am wondering if the organisation name could be displayed:

https://www.whois.com/whois/172.217.3.68

I suppose Palo Alto cant so I am wondering if there is any way I could "teach" Palo the Information I need.