HTTP response code logging

[rKarki]

So PAN doesn't log HTTP response code, at least I do not seem to find one under URL Filtering logs, and if it doesn't, then how Palo could claim that it is the replacement of proxy?

[kiwi]

Hi @rKarki ,

Palo Alto NGFW and proxies are similar in that they are both designed to protect the network ... that is where the similarities end.

A proxy and a NGFW are 2 different things.  Don't use a NGFW as a proxy 😉

I think the following pages explain the differences and why not to use your NGFW as a proxy.

What is a proxy server 

palo-alto-networks-vs-proxy-based-products 

Did you check this previous discussion on the same topic ? :

Palo-Alto-firewall-vs-Web-Proxy 

Cheers,

-Kiwi.

[rKarki]

Hello Kiwi,

I am pretty sure I did read the comparison docs once before and I should have acknowledged from the start that "PAN is NGFW and a proxy is a proxy". At that time I just thought that I could easily replace proxy with PAN, but after knowing some of it's fact, I figured I was wrong. Every company's requirements are different so do we. Anyway, PAN is a great FW and I am not looking this discussion to go towards NGFW vs Proxy particularly. 

Thanks!

[rKarki]

Do anyone in this community care about the the http response code on the PAN URL logs? If you do and getting it today, then can you please let me know how you did it. 

I found this workaround and have implemented also but the log is a bit mess. This is about creating vulnerability custom signatures and for sure, it fires up event/logs based on a traffic match. The problem that I am having with this is to create a report based on response and that is for URL (http/s) only. This is even harder from a remote log collector eg. Splunk. 

https://live.paloaltonetworks.com/t5/Community-Skillets/HTTP-Response-Codes/ta-p/314255

thanks!