Traffic Logs - Resolve Hostname - Micrsoft Public IPs

Reply
Highlighted
L0 Member

Traffic Logs - Resolve Hostname - Micrsoft Public IPs

Dear Commuity,

I am very new to Palo Alto Firewalls. I saw, that you can check the "Resolve hostname" checkbox when viewing Traffic Logs. Sadly a lot of IPs are not being resolved. I examed a few random samples and notices, the IPs mostly belong to Microsoft.

 

I am now wondering, if there is some kind of way, that I could see this in Traffic Log directly. I dont necessarily need a hostname. I am happy if I would be able to display organization name behind the IP.

 

Regards,

Eve Meier

Highlighted
L4 Transporter

That would be nice right? ;) you will be annoyed and frustrated with AWS, Akamai, Azure, etc.. at least the google stuff all resolves as 1e100 so we know who that is but you really do not know who is behind the AWS/Azure/etc IPs without a little extra legwork. Typically what I will do is go to my Linux VM, pull up the IP in firefox->click add exception (because the cert will not match the IP)->click view cert and then just look at the certname. There may be other ways so if anyone else has tips and tricks for this I am going to watch this thread.

 

 

Highlighted
L7 Applicator

Open command prompt in Windows

ping www.google.com

 

In my case result was 172.217.3.68

 

 

But if you ping IP and try to resolve to name

ping -a 172.217.3.68

 

Result was mia07s54-in-f4.1e100.net

 

It is not something that Palo can do - it depends on what entry is in Reverse DNS zone for this IP.

Enterprise Architect @ Cloud Carib www.cloudcarib.com
ACE, PCNSE, PCNSI
Highlighted
L0 Member

Hi,

I understand what you mean. As mentioned hostname - even if it can be resolved - will often not be very helpfull in case of Microsoft, Google and others. Thats why I am wondering if the organisation name could be displayed: 

https://www.whois.com/whois/172.217.3.68

 

I suppose Palo Alto cant so I am wondering if there is any way I could "teach" Palo the Information I need.

For example this List of Public IP Range Microsoft uses I found:

https://www.microsoft.com/en-us/download/details.aspx?id=53602

 

btw thanks for all the fast replies :)

Regards,

Eve Meier

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!