I am very new to Palo Alto Firewalls. I saw, that you can check the "Resolve hostname" checkbox when viewing Traffic Logs. Sadly a lot of IPs are not being resolved. I examed a few random samples and notices, the IPs mostly belong to Microsoft.
I am now wondering, if there is some kind of way, that I could see this in Traffic Log directly. I dont necessarily need a hostname. I am happy if I would be able to display organization name behind the IP.
That would be nice right? ;) you will be annoyed and frustrated with AWS, Akamai, Azure, etc.. at least the google stuff all resolves as 1e100 so we know who that is but you really do not know who is behind the AWS/Azure/etc IPs without a little extra legwork. Typically what I will do is go to my Linux VM, pull up the IP in firefox->click add exception (because the cert will not match the IP)->click view cert and then just look at the certname. There may be other ways so if anyone else has tips and tricks for this I am going to watch this thread.
Open command prompt in Windows
In my case result was 18.104.22.168
But if you ping IP and try to resolve to name
ping -a 22.214.171.124
Result was mia07s54-in-f4.1e100.net
It is not something that Palo can do - it depends on what entry is in Reverse DNS zone for this IP.
I understand what you mean. As mentioned hostname - even if it can be resolved - will often not be very helpfull in case of Microsoft, Google and others. Thats why I am wondering if the organisation name could be displayed:
I suppose Palo Alto cant so I am wondering if there is any way I could "teach" Palo the Information I need.
For example this List of Public IP Range Microsoft uses I found:
btw thanks for all the fast replies :)
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!