topic Re: HTTP response code logging in General Topics

HTTP response code logging

rKarki — Sun, 26 Apr 2020 04:36:57 GMT

So PAN doesn't log HTTP response code, at least I do not seem to find one under URL Filtering logs, and if it doesn't, then how Palo could claim that it is the replacement of proxy?

Re: HTTP response code logging

kiwi — Sun, 26 Apr 2020 18:35:08 GMT

Hi @rKarki ,

Palo Alto NGFW and proxies are similar in that they are both designed to protect the network ... that is where the similarities end.

A proxy and a NGFW are 2 different things. Don't use a NGFW as a proxy 😉

I think the following pages explain the differences and why not to use your NGFW as a proxy.

What is a proxy server

palo-alto-networks-vs-proxy-based-products

Did you check this previous discussion on the same topic ? :

Palo-Alto-firewall-vs-Web-Proxy

Cheers,

-Kiwi.

Re: HTTP response code logging

rKarki — Mon, 27 Apr 2020 01:53:36 GMT

Hello Kiwi,

I am pretty sure I did read the comparison docs once before and I should have acknowledged from the start that "PAN is NGFW and a proxy is a proxy". At that time I just thought that I could easily replace proxy with PAN, but after knowing some of it's fact, I figured I was wrong. Every company's requirements are different so do we. Anyway, PAN is a great FW and I am not looking this discussion to go towards NGFW vs Proxy particularly.

Thanks!

Re: HTTP response code logging

rKarki — Wed, 29 Apr 2020 01:22:26 GMT

Do anyone in this community care about the the http response code on the PAN URL logs? If you do and getting it today, then can you please let me know how you did it.

I found this workaround and have implemented also but the log is a bit mess. This is about creating vulnerability custom signatures and for sure, it fires up event/logs based on a traffic match. The problem that I am having with this is to create a report based on response and that is for URL (http/s) only. This is even harder from a remote log collector eg. Splunk.

https://live.paloaltonetworks.com/t5/Community-Skillets/HTTP-Response-Codes/ta-p/314255

thanks!