topic Re: can we log urls for deny rule? in General Topics

can we log urls for deny rule?

SThatipelly — Thu, 15 Aug 2019 20:43:13 GMT

I am trying to configure a sec policy so it will show the url log though the traffic is blocked. has anyone tried it? Please let me know.

thanks.

Re: can we log urls for deny rule?

ydhanuka — Fri, 16 Aug 2019 06:04:40 GMT

Hi There,

Yes, you can log the blocked URL sessions on firewall or panorama. Just enable the logging in the action Tab.

I would suggest to go through this short demo which will help answer related questions.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClmgCAC

Thanks,

Yogesh

Re: can we log urls for deny rule?

SThatipelly — Fri, 16 Aug 2019 12:15:58 GMT

@ydhanuka Thanks for the response. I do have url filtering on allow rules but wasn't sure if the traffic is going to be allowed if I apply this to a deny rule.

Re: can we log urls for deny rule?

JulioMancia — Fri, 16 Aug 2019 15:54:37 GMT

So I am doing an allow / deny by doing this. For example geo-blocked country let's say Russia as destination:

Security policy set to allow for TCP 80/443 (SSL/Web-Browsing) for destination Russia
URL Filtering policy with all categories are set to Block. This policy is assigned to Security policy mentioned above.
Security policy set to Deny any any for Russia, this will cover the rest of the TCP/UDP ports

By doing this I create a Layer 3/4 Allow and a Layer 7 Deny. I then can look at my URL Filtering logs and see exactly what URL's have been blocked for my Geo-Blocked country Russia.

Re: can we log urls for deny rule?

MP18 — Fri, 16 Aug 2019 17:45:36 GMT

for that you need to create destination as any

then under url say specfic site.

then you can see url logs but no traffic logs