In URL Filtering logs, URLs are not showing the subdomains. Showing upto ( .com/ )

[ram.balaji]

Hi Team,

In Strata Cloud Manager while seeing the URL filtering logs I am not able to see the subdomain URLs.

But in another tenant, I could see the complete logs after ( .com/ )

Eg: live.paloaltonetworks.com/t5/forums/postpage/board-id/Prisma_Access_Cloud_Management_Discussio

regards,

Akash Thangavel

Network Security Engineer

[aleksandar.astardzhiev]

Hi @ram.balaji ,

The most plausible reason is that no SSL decryption is applied on the firewall generating these logs.

Without TLS/SSL decryption, PAN firewall is inspecting the SNI (server name indicator), from the SSL negotiation. This is sent by the client to the sever to indicate which host the client is trying to reach so the server can know which SSL certificate to provide (if the server host multiple sites).

Because traffic is encrypted and no decryption is applied FW cannot see the full URL from the HTTP headers and will use the SNI for web filtering categorization.