topic Re: Anyone know what happens when you have traffic set to deny/drop and you have URL filtering profi in General Topics

Anyone know what happens when you have traffic set to deny/drop and you have URL filtering profile

junior_r — Wed, 18 Sep 2019 21:44:34 GMT

Anyone know what happens when you have traffic set to deny/drop and you have URL filtering profile applied? Does it log the traffic in URL monitor when its blocked?

Re: Anyone know what happens when you have traffic set to deny/drop and you have URL filtering profi

MP18 — Wed, 18 Sep 2019 22:25:30 GMT

no traffic will not log in url filtering profile.

Re: Anyone know what happens when you have traffic set to deny/drop and you have URL filtering profi

tommyschoemans — Thu, 19 Sep 2019 05:42:00 GMT

Hello,

Logs will be created in the url filtering log. For example I've created a policy 'Block Malicious Web Categories' and have put the malware, phising, c&c in the url category option of the policy , action set to deny and attached a URL filtering profile with all categories set to block. To profile is there for logging and presenting the user with a block page.

kr,

Tommy

Re: Anyone know what happens when you have traffic set to deny/drop and you have URL filtering profi

junior_r — Thu, 19 Sep 2019 05:56:25 GMT

Hi Tommy,

will you still get a block page if URL filtering profile had all categories set to alert and action on rule set to deny?

Thanks

Re: Anyone know what happens when you have traffic set to deny/drop and you have URL filtering profi

tommyschoemans — Thu, 19 Sep 2019 05:58:09 GMT

Hello,

No you wont get the block page if only the action is deny on the policy. It is the security profile that triggers the block page.

Tommy

Re: Anyone know what happens when you have traffic set to deny/drop and you have URL filtering profi

junior_r — Thu, 19 Sep 2019 06:39:47 GMT

Hi Tommy,

Just did a test anytime I add a URL category to a deny rule I get the block page with or without the URL filtering profile. The URL filtering profile just adds extra entry in the URL filtering log.

Thanks

Re: Anyone know what happens when you have traffic set to deny/drop and you have URL filtering profi

tommyschoemans — Thu, 19 Sep 2019 06:56:01 GMT

Hi,

Which version of PANos are you testing this on?

kr,

Tommy

Re: Anyone know what happens when you have traffic set to deny/drop and you have URL filtering profi

BatD — Thu, 19 Sep 2019 08:21:38 GMT

@junior_r Please see below the detailed explanation of the firewall packet flow sequence.

Security Profiles/Content Inspection are ALWAYS applied after the policy evaluation. If the policy set to drop, the profiles will never be applied:

https://knowledgebase.paloaltonetworks.com/servlet/rtaImage?eid=ka10g000000bxnJ&feoid=00N0g000003VPSv&refid=0EM0g000001AeP6

Re: Anyone know what happens when you have traffic set to deny/drop and you have URL filtering profi

tommyschoemans — Thu, 19 Sep 2019 12:27:31 GMT

Hey,

I just re-tested it with panos 9.0.2 and apparently you don't need to url filter profile anymore to get a block page and it is also loggen in the url filter log.

I used to test this in 8.1 and there I did need to put the url profile...

kr,

Tommy