About Marsooq_A

Hi @Marsooq_A ,   "url filtering profile created for monitoring with action of all category as alert. And this profile has been called on default interzone policy (action deny)." No security profile is applied on traffic matching rule with action deny. If you will deny the traffic, why would you bother to perform additional inspection. For that reason if traffic is hitting the default deny rule, firewall will not perform any additional inspection so it wouldn't be able to identify the URL   It is possible that firewall will initially allow a connection and once it gets some actual data (not just network protocols headers, etc), to perform new policy lookup and this time to not match the original rule and fall to "default-intrerzone". In this case this session will generate at least two log entries - one from the original rule allowed the connection and one from the intrerzone rule.   In your original post you mentioned that you are using URL Filtering profile, but in your latest rely you mentioned that you have configured specific URL as destination criteria in your rule. You need to understand that these two are totally different thinks: - URL Filter security profile will, filter the URL only after the traffic is first allowed by the rule appling this profile. - URL in security rule - is providing additional matching criteria. Traffic will be allowed only if it matched the specified URL. And after that this traffic will be subjected to additional inspection, defined from the attached profiles (if any). So in this case is it is very possible that the TCP-handshake to be allowed by this rule and once the actual data pass through the firewall, the detected url to not match the one in the rule so during additional policy lookup, traffic will be droped because it is matching only default-intrerzone. In that case when you check your logs you will see that "session has matched default-interzone", but if you open the logs details, you should see also the log entry of the rule that this traffic has matched on the initial policy lookup.     ... View more

it shows which gateway has the preference for the specific subnet   the local rib should look something like below the peer  with the highest priority (bold) has the * as it is the preferred route for 10.1.80.0/24   *10.1.80.0/24      10.1.1.1 peer-int-01 0 180 i/c 0 0 666 10.1.80.0/24        10.1.1.2 peer-int-02 0 170 i/c 0 0 666 ... View more

I was not subscribed. ... View more

Hello,   The Cortex Host Firewall integrates with Windows Firewall and therefore it is the Windows Firewall logs at the moment you would need to check.     Kind regards, Graeme ... View more

Hi @Marsooq_A  if you install it using MSI, there is parameter:  RESTRICT_LIVE_TERMINAL=1  — Use to disable Live Terminal More info here: https://docs.paloaltonetworks.com/cortex/cortex-xdr/7-1/cortex-xdr-agent-admin/cortex-xdr-agent-for-windows/install-the-cortex-xdr-agent-for-windows Jan ... View more