How to defer allow or block action, only log based on application?

[rienzom]

I don't know if this is the best board to post this on.  If not, please move it or let me know to repost it on the appropriate board.

I am trying to log all vpn/anonymizer connections between all zones.  The way I have figured to do this is an allow rule that looks like this:

rule 1: allow (any zone -> any zone) application (bittorrent, ipsec-esp, ike, tor, tor2web, i2p, ssh, ssh-tunnel, stun)

ruel 1+n: other rules that are blocks or allows based on different criteria.

Obviously, the problem with having an allow rule to generate logs at the top of the policy list is that some of the rules below might block these protocols for certain zones.  How do I set a rule for logging but defer processing to a higher numbered rule/is there a better way to achieve what I want and am I going about this the wrong way?

[OtakarKlier · Accepted solution]

Hello,

What I do is add a DENY ALL policy at the bottom of all my rule sets and then set all of the policies to log at session end. This way you will see all traffic, allowed or denied.

Hope that helps.