Block TLD and Security Profiles in Monitor and Log Details

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Block TLD and Security Profiles in Monitor and Log Details

L2 Linker

I am working on blocking a TLD using a URL filter. I have multiple URL Filtering Profiles.

 

I have the TLD block working, but the lack of security profile information in the Monitor tab view and detail logs makes it difficult to troubleshoot.

 

Is there a way to display what security profile(s) are being hit? I understand these are tied to the rule, but an option to display them in the Monitor tab and seeing them listed in the log details would help.

5 REPLIES 5

Cyber Elite
Cyber Elite

Hello,

There should be a column named Rule. This is the policy that is allowing or denying the traffic. Also in the Security Policy make sure you have the 'Log at session end' box checked.

If the Rule column is not visable, however your mouse orver on the column heads and then select the drop down arrow then Columns, then select Rule.

 

Hope that helps.

L6 Presenter

@mike406 wrote:

 

Is there a way to display what security profile(s) are being hit? I understand these are tied to the rule, but an option to display them in the Monitor tab and seeing them listed in the log details would help.


 

 

Yes and no.  Chicken and Egg scenario.

 

In the logs it's not going to say traffic matched "x" security profile, but it will say traffic matched "x" security rule.  Traffic can only match "x" security rule if traffic matches all criteria listed in your security rule.  So you can infer a particular security profile is being matched.

"So you can infer a particular security profile is being matched."

 

I understand, but this is what I don't want to have to do. Too much jumping around in the console just to find it out.

Monitor -> Policies -> Rule -> Group Profile -> Objects -> Security Profile Groups -> URL Filtering Profile -> URL Filtering

 

Would be much easier if the information was displayed. Sending via syslog would help as well.

 

Do I need to submit as a product enhancement or feature request?


@mike406 wrote:

"So you can infer a particular security profile is being matched."

 

I understand, but this is what I don't want to have to do. Too much jumping around in the console just to find it out.

Monitor -> Policies -> Rule -> Group Profile -> Objects -> Security Profile Groups -> URL Filtering Profile -> URL Filtering

 

Would be much easier if the information was displayed. Sending via syslog would help as well.

 

Do I need to submit as a product enhancement or feature request?


 

Huh?  I'm not sure I'm understanding what your issue or concern is.  (I can't follow the flow you put in.)

 

Regarding a FR...you can try, but don't waste your time.  It's never going to happen.  If you want URL logs you're going to need to use a URL profile.  I don't see Palo ever changing that.

My point is that I shouldn't have to guess or infer what security profile is being hit, the system should tell me.

 

I'll bring it up with my PA sales team and SE. 

  • 2903 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!