About cosx

Thanks. Wasn't sure if custom URLs worked. So what I did was create a custom URL category for the sites I want to block: # show profiles custom-url-category custom-url-category {   wpad {     list [ wpad.am.example.com wpad.example.com];   } } Then I create a policy rule that uses that URL category, # show rulebase security rules "Block WPAD" "Block WPAD" {   source any;   destination any;   service application-default;   application web-browsing;   action allow;   source-user any;   option {     disable-server-response-inspection no;   }   negate-source no;   negate-destination no;   disabled no;   log-end yes;   from dc;   to internal;   log-setting Panorama-ALL;   hip-profiles any;   log-start no;   category wpad; } Don't be mislead by the name. The action us currently "allow" while I make sure the rule does not catch traffic inadvertently. And I am a little puzzled by the results. If I do hit a URL that matches the URL category, I get the expected entry in my logs. However, I see a lot of logs, Time            App         From        Src Port   Source Rule            Action      To          Dst Port   Destination                 Src User    Dst User =============================================================================== 2012/12/03 10:13:41 incomplete  dc   63803 172.31.152.165 Block WPAD      allow       internal    80    192.168.208.131                                2012/12/03 10:13:37 incomplete  dc   50620 10.10.10.77 Block WPAD      allow       internal    80    192.168.228.45                                2012/12/03 10:13:36 incomplete  dc   63802 172.31.152.165 Block WPAD      allow       internal    80    192.168.208.131 Even though they are "incomplete," I believe the connections are in fact working. Not sure what these logs mean. I believe they are successful HTTP connections, but the URL does not match. I would expect not to see any log entry at all if that were the case. Is this expected behavior? ... View more