Logging of blocked HTTP traffic

[chris_harrington]

All,

We have a proxy environment where LAN users requesting Internet sites have to go through the proxy. Our proxy is on the LAN side of the PaloAlto so that traffic goes from User->Proxy->PaloAlto->Internet. There is a rule on the PaloAlto that blocks any HTTP(S) traffic that hits the firewall if it doesnt come from the Proxy IP addresses. Due to misconfigurations we have plenty of web traffic hitting that block rule. We would like to be able to log and see the actual HTTP requests.

Is there a way to log this infomation? If we enable URL filtering for that Block rule would we be able to see the HTTP requests? Is it possible to redirect this traffic to another IP address?

Any ideas would be appreciated.

Thanks,

--Chris

[rmonvon]

If your HTTP(S) requests are truly encrypted via SSL, then the HTTP content inside is not visible.  You may consider using SSL decryption to decrypt the traffic to see the HTTP inside the SSL.

If the blocked traffic is simply HTTP over port 443 without any ssl, then you can allow the traffic and create a URL profile to block all categories.  I think that will log the URLs for you.