Need clarification on URL Filtering logs

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Need clarification on URL Filtering logs

L1 Bithead

Hi everyone,

Please help me get through this.

We have configured PA-450 firewall and everything is working fine as expected.
But, We have used the option URL category in the security policy without an URL filtering profile for all user group. Which is working fine but I cant see any URL user activity report.
But we need block URL summary report.

Then I found out that we need block or alert action in order to get URL logs.

Current Scenario
=================
(Its not the real configuration setup from the firewall, just a prototype)

Arun_R_0-1713249886072.png

The above screenshot is the current scenario of the security policies which has URL category directly mapped in polices.
There are no Block URL user activity report generated.

 

Please observe the below workaround.

Workaround
============

Arun_R_1-1713250275858.png

Please observe the above screenshot.
Above we have all the URL category mapped allow policies which generates no logs.
What if I create a security policy with a URL profile which blocks all the category at the bottom.

All the allowed traffic will hit on the above rules for all user groups and other traffics will hit on the bottom block rule and generates the Block URL user activity summary ... right ?

Please correct me if I am wrong.

NOTE: We don't want to use URL Filtering Profile. Instead we need the carry on with current scenario.

Please help me with this doubt.

 

Thanks in advance 🙂

1 accepted solution

Accepted Solutions

correct

the log is generated from the url decoder action, which is only triggered if you let the 'base' traffic (tcp connection) pass which is achieved by setting the security rule to allow

Advantage of this approach is also that users will receive a nice block page in their browser versus a failed connection with no context

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

View solution in original post

3 REPLIES 3

Cyber Elite
Cyber Elite

you'll need to set that 'block all' rule to allow since a deny rule will not put packets into l7 for inspection, so you wont hit the url filtering block action, and get no logs

 

Dare i ask why you're not using url filtering to allow url categories? 😉

 

 

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

Hi @reaper 

 

Thank you for your reply,

 

So if we configure the last Block Rule and set all the predefined URL category to "Block" and rule as "Allow"

 

We will get the URL user activity summary right ?

correct

the log is generated from the url decoder action, which is only triggered if you let the 'base' traffic (tcp connection) pass which is achieved by setting the security rule to allow

Advantage of this approach is also that users will receive a nice block page in their browser versus a failed connection with no context

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization
  • 1 accepted solution
  • 499 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!