Blocked traffic log has no url logged

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Palo Alto Networks Approved
Palo Alto Networks Approved
Community Expert Verified
Community Expert Verified

Blocked traffic log has no url logged

L4 Transporter

I want to look at the url address of a data packet that was blocked by a deny rule. I had url filtering applied on the rule but the denied traffic log shows the url category but not the url address. Please advise me in logging url address for denied traffic.

 

TIA

8 REPLIES 8

Cyber Elite
Cyber Elite

@SThatipelly,

In all likelyhood you are blocking this traffic before the firewall would ever look at the URL, and therefore there is no reason to record this information. 

Say for instance I've blocked access to 54.225.121.9. The URL of that IP is never recorded because the firewall never looks at it, because it knows that it needs to block the traffic before it ever needs to look at the URl. 

@BPryhow come it showes the url category?

@SThatipelly

How does your securitd policy rule look like or more precisely: how did you configure URL filtering? Did you add an URL filtering security profile or you just added the categories directly to the rule?

I had the complete url filering applied under profiles in action tab.

@SThatipelly

Did you check the "URL Log" or opened the detail of such a denied session in the traffic log?

L3 Networker

Sorry to bother you, may I ask did you figure out why the denied traffic log shows the url category but not the url address? Since my customer faced the same issue, there are only custom url category defined in the security rule and the action is deny. 

Were you ever able to figure this out? I have the same question

L7 Applicator

I think it depends on how the traffic is blocked. If you have an IP based drop rule, the firewall is not able to log the actual URL. With a drop rule with an URL added direcrly to the rule a log is written, at least in new PAN-OS versions, so maybe this was a bug in the past, that then no url log was written - or a new feature that was implemented.

  • 4419 Views
  • 8 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!