Blocked traffic log has no url logged

[SThatipelly]

I want to look at the url address of a data packet that was blocked by a deny rule. I had url filtering applied on the rule but the denied traffic log shows the url category but not the url address. Please advise me in logging url address for denied traffic.

TIA

[BPry]

@SThatipelly,

In all likelyhood you are blocking this traffic before the firewall would ever look at the URL, and therefore there is no reason to record this information. 

Say for instance I've blocked access to 54.225.121.9. The URL of that IP is never recorded because the firewall never looks at it, because it knows that it needs to block the traffic before it ever needs to look at the URl. 

[SThatipelly]

@BPryhow come it showes the url category?

[Remo]

@SThatipelly

How does your securitd policy rule look like or more precisely: how did you configure URL filtering? Did you add an URL filtering security profile or you just added the categories directly to the rule?

[SThatipelly]

I had the complete url filering applied under profiles in action tab.

[Remo]

@SThatipelly

Did you check the "URL Log" or opened the detail of such a denied session in the traffic log?

[zji]

Sorry to bother you, may I ask did you figure out why the denied traffic log shows the url category but not the url address? Since my customer faced the same issue, there are only custom url category defined in the security rule and the action is deny. 

[rt839134]

Were you ever able to figure this out? I have the same question

[Remo]

I think it depends on how the traffic is blocked. If you have an IP based drop rule, the firewall is not able to log the actual URL. With a drop rule with an URL added direcrly to the rule a log is written, at least in new PAN-OS versions, so maybe this was a bug in the past, that then no url log was written - or a new feature that was implemented.