About LucaMarchiori

Hi @ash83    You need to start with a log forwarding profile, there you define a specific filter for the threatlogs (you either filter on the severity or on specific threat ID or something completely different). As action you then choose to tag the source or destination IP (depending on your filter) and assign a Tag to these IPs. After that you create a dynamic address group with the criteria the tag you created for that. From this point you can use the address group in your policy to block connections from or to these IPs.   Hope this helps. ... View more

Hi @lmori your solution worked for Heartbleed.  For threats that have no such distinctive name, would you think it's possible to use directly the threat ID?   For instance:   - contains(threat_name, '(36397)') == true   ... View more

Hi @lmori   Thanks for pointing me in the right direction.  I think that the problem was I had manually created a copy of a config file.  After deleting that file, export works just fine!  A little (linux) knowledge... 🙂   Rule issue fixed as well...   There was a typo (dst_zone) that got into some of the rules. "dest_zone" is the correct field.     Luca ... View more

@xhoms  It looks as though deleting the sudden_death line did the trick, thanks.   Luca ... View more

@mario11584 wrote: This is great! Though I do run into accuracy issues, as has been mentioned, after running some tests. A lot of my traffic is encrypted too, so it shows up as SSL traffic and not YouTube. Though I did some see some application traffic for YouTube over 443, which I find interesting. Why does some of it show up as SSL and some as YouTube, both over 443? I would obviously need SSL decryption to dig deeper into the SSL traffic.   Enabling SSL decryption would make the report more accurate, but one does not "just" enable SSL decryption without testing first.     Your other option is to get a better handle on how the firewall sees Youtube traffic as a whole (app-id=youtube, app-id=ssl+some other indicator, etc.)  Does the actual video stream get tagged as "youtube" or "ssl"?  If it is identified as youtube, that makes it easy for your reporting goals.  If the stream is identified as ssl (or a mix of the two), then you'll need to dig deeper into your logs to figure out what's going on.  (I recommend using the unified log viewer and adding both the URL and Session ID colums to the list).    It could be that the Youtube app-id needs some updating/additional coverage - in which case open a support ticket.  It could be that only decryption will resolve this issue.  Or finally, you could find some additional information in the unified logs that allows you to generate a report combining all youtube and specific ssl traffic together.   ... View more

Hi Willian,   I have an existing security rule that already allows NetPath traffic.  I created a QoS rule with the apps you listed, and I can see the rule showing up in Network > QoS > Statistics > QoS Rules.  So maybe that's it? ... View more

Thank you, that worked.  Don't know why I was expecting it to work without changing the client's DNS settings... 🙂  I'm checking if boss is happy with safe search for all, before touching our DNS servers. ... View more