topic Re: Block TLD and Security Profiles in Monitor and Log Details in General Topics

Block TLD and Security Profiles in Monitor and Log Details

mike406 — Tue, 26 Feb 2019 16:38:12 GMT

I am working on blocking a TLD using a URL filter. I have multiple URL Filtering Profiles.

I have the TLD block working, but the lack of security profile information in the Monitor tab view and detail logs makes it difficult to troubleshoot.

Is there a way to display what security profile(s) are being hit? I understand these are tied to the rule, but an option to display them in the Monitor tab and seeing them listed in the log details would help.

Re: Block TLD and Security Profiles in Monitor and Log Details

OtakarKlier — Tue, 26 Feb 2019 19:11:49 GMT

Hello,

There should be a column named Rule. This is the policy that is allowing or denying the traffic. Also in the Security Policy make sure you have the 'Log at session end' box checked.

If the Rule column is not visable, however your mouse orver on the column heads and then select the drop down arrow then Columns, then select Rule.

Hope that helps.

Re: Block TLD and Security Profiles in Monitor and Log Details

Brandon_Wertz — Wed, 27 Feb 2019 13:54:59 GMT

@mike406 wrote:

Is there a way to display what security profile(s) are being hit? I understand these are tied to the rule, but an option to display them in the Monitor tab and seeing them listed in the log details would help.

Yes and no. Chicken and Egg scenario.

In the logs it's not going to say traffic matched "x" security profile, but it will say traffic matched "x" security rule. Traffic can only match "x" security rule if traffic matches all criteria listed in your security rule. So you can infer a particular security profile is being matched.

Re: Block TLD and Security Profiles in Monitor and Log Details

mike406 — Fri, 01 Mar 2019 18:38:28 GMT

"So you can infer a particular security profile is being matched."

I understand, but this is what I don't want to have to do. Too much jumping around in the console just to find it out.

Monitor -> Policies -> Rule -> Group Profile -> Objects -> Security Profile Groups -> URL Filtering Profile -> URL Filtering

Would be much easier if the information was displayed. Sending via syslog would help as well.

Do I need to submit as a product enhancement or feature request?

Re: Block TLD and Security Profiles in Monitor and Log Details

Brandon_Wertz — Fri, 01 Mar 2019 19:33:07 GMT

@mike406 wrote:
"So you can infer a particular security profile is being matched."

I understand, but this is what I don't want to have to do. Too much jumping around in the console just to find it out.
Monitor -> Policies -> Rule -> Group Profile -> Objects -> Security Profile Groups -> URL Filtering Profile -> URL Filtering

Would be much easier if the information was displayed. Sending via syslog would help as well.

Do I need to submit as a product enhancement or feature request?

Huh? I'm not sure I'm understanding what your issue or concern is. (I can't follow the flow you put in.)

Regarding a FR...you can try, but don't waste your time. It's never going to happen. If you want URL logs you're going to need to use a URL profile. I don't see Palo ever changing that.

Re: Block TLD and Security Profiles in Monitor and Log Details

mike406 — Fri, 01 Mar 2019 21:00:00 GMT

My point is that I shouldn't have to guess or infer what security profile is being hit, the system should tell me.

I'll bring it up with my PA sales team and SE.