So this is stemming from a security policy that I've since had changed, but in essence this was a FQDN drop, so a L3 drop. The original intent was users wouldn't be getting a response page at all. The security team didn't want "callbacks" to malicious domains so there was just a L3 drop rule for specific stuff.
I've since gotten this changed where these types of things are getting integatred into a L7 block so users would see a response page.
In short I'm trying to troubleshoot something that I don't foresee being a big issue moving forward, but I'm still curious to understand how understand the academic question of how can I see an "end-to-end" log of a single session so to speak from when a user tries to vist a single page without creating a specific user report.
... View more
