topic Re: how can I generate url logs for an allow rule with url category selected but not url filtering p in General Topics

how can I generate url logs for an allow rule with url category selected but not url filtering prof?

SThatipelly — Mon, 23 Sep 2019 18:44:36 GMT

how can I generate url logs for an allow rule with url category selected but not url filtering prof?

Re: how can I generate url logs for an allow rule with url category selected but not url filtering p

OtakarKlier — Mon, 23 Sep 2019 21:08:14 GMT

Hello,

Can you elaborate a bit, I'm not sure I understand what your question is. Is your security policy set to log at session end?

Please advise,

Re: how can I generate url logs for an allow rule with url category selected but not url filtering p

BatD — Tue, 24 Sep 2019 07:26:54 GMT

@SThatipelly You can not. URL logs are only generated by the URL fitleing profile. If you need URL log for the rule, keep the URL match conditiona, but also apply URL filtering profile with cusotmer category mathcing your URLs and ation set to "alert"? This will work even if you don't have URL filtering license.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClKvCAK

Re: how can I generate url logs for an allow rule with url category selected but not url filtering p

SThatipelly — Tue, 24 Sep 2019 13:02:35 GMT

@BatD Doesn't that allow traffic to all alert categories?

Re: how can I generate url logs for an allow rule with url category selected but not url filtering p

SThatipelly — Tue, 24 Sep 2019 13:05:44 GMT

@OtakarKlier Sorry for my poor explanation. I want to allow few users to tinyurl.com and block everyone else. Also, I would like to see their allowed attempts logged in url filtering logs. I am trying to configure this rule so it would only allow access to that specific website and log urls.

Re: how can I generate url logs for an allow rule with url category selected but not url filtering p

BatD — Tue, 24 Sep 2019 13:05:47 GMT

@SThatipelly If I understand correctly, you already have URL in the policy match condtion under "Service/URL Categorie" tab.

If you do, only the traffic matching those categories will be allowed and the URL filtering profile is only applied to allowed trafic.

Re: how can I generate url logs for an allow rule with url category selected but not url filtering p

SThatipelly — Tue, 24 Sep 2019 13:10:50 GMT

@BatD Interesting. I'll try this on a test machine and let you know if it works.

thanks.

Re: how can I generate url logs for an allow rule with url category selected but not url filtering p

SThatipelly — Tue, 24 Sep 2019 13:23:04 GMT

this works partially. Good news is the rule is looking at just the website in 'service/url category' but is blocking the access as the url is in blocklist in the url filtering profile.

In short, the rule is looking at the 'service/url category' field but allowing/denying based on the url filtering profile.

Re: how can I generate url logs for an allow rule with url category selected but not url filtering p

BatD — Tue, 24 Sep 2019 14:47:03 GMT

As mentioned, you need to add your URL in Custom URL category and set the action to "Alert".

Re: how can I generate url logs for an allow rule with url category selected but not url filtering p

SThatipelly — Thu, 26 Sep 2019 19:45:53 GMT

@BatD Yeah. I hate to do hat but I think that's the only option left for me.

thanks. for the response.