topic Re: How to see a specific incoming IP in General Topics

How to see a specific incoming IP

Randolp_Technologent — Wed, 13 Jan 2021 17:17:01 GMT

Hello, I am new to Palo Alto Firewalls still learning. I as asked to see a specific IP that is attempting to connect to my FW. Can someone please point me in the direction to see an incoming IP? I see on the GUI "Monitoring" and "ACC" tabs. Is there Training Material or commands that show how?

Re: How to see a specific incoming IP

Mick_Ball — Wed, 13 Jan 2021 18:06:09 GMT

you have a few options but for me I just use the monitor tab and select "traffic" from the LH side.

click on any source IP in the GUI, this will auto fill the search bar above, modify this to your required IP and click on the apply filter arrow to the right.

you need to be aware that traffic will only appear in the monitor tab if logging is set in the policies.

if there is no policy for the attempted connection then you will need to override the default interzone policy and set logging to session start.

you can also create deny all policies specific to interfaces/services etc.(with logging enabled) but be careful as you could be setting up your own denial of service if not careful.

Re: How to see a specific incoming IP

Randolp_Technologent — Wed, 13 Jan 2021 18:29:12 GMT

Awesome information my friend! I used this in the "Monitor" tab and input this cmd " (addr.src in X.X.X.X) I did not see anything and then I used an IP that is in use and I was able to see all the traffic. Thanks for your help!

Re: How to see a specific incoming IP

jdelio — Wed, 13 Jan 2021 18:56:32 GMT

Here is a screen shot of the logs..