03-24-2021 05:45 AM
I would really like the capability to setup packet captures for traffic that hits specific security rules. For example, we have rules that block outbound connections to Palo's dynamic IP list for known malicious IP addresses and would like packet captures taken when traffic hits that rule. I've not seen that capability and haven't seen a forum post related to it for several years. Anyone know if this is currently supported?
03-24-2021 10:45 AM
At this time packet captures are still pretty much source-destination-port type of deal
You could reach out to your local sales guys to submit a feature request, that way it may eventually get added (post the FR number here so we can all reach out to our sales guys and vote for this feature to be added 😉 )
03-24-2021 12:29 PM
Hello,
What type of information are you looking to get out of the pcap that already isnt in the logs?
Just curious at the use case to better assist.
Regards,
03-24-2021 07:37 PM
The answer is a bit open ended. It depends on the rule being hit or the traffic we want to monitor. For example, traffic going outbound hitting the known malicious IP list could be any service or application including NTP, DNS, HTTP, etc. Packet captures would give us more details including potential payload info, URIs, hostnames in queries, etc. Don't always see that in the firewall logs.
03-25-2021 09:45 AM
Hello,
That was my assumption but wanted to be sure. Within the Security Profiles, you can set them to perform a pcap. This is however not a full blown pcapc, but something that the PAN san in brevity and already knows about. However if you want full pcaps, a 3rd party solution would be the best answer.
Hope this helps.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!