How to Capture Traffic Using Access Rules

03/26/2020 233 14021

DESCRIPTION:

Often it is useful to capture traffic that is going to a specific FQDN or IP address for auditing or reporting purposes. We can create an Access Rule and capture traffic that only applies to that rule. This can be useful when there is malicious traffic going out from a network. Administrators may want to block the traffic (via access rules) but also capture the traffic in the packet capture to view where the source is coming from to mitigate the incident.

RESOLUTION:

Step 1: Create an Access Rule for the traffic flow of your scenario. This example will block all outbound connections going to IP address 1.1.1.1.

Note: When creating the Access Rule select "Enable Packet Monitor". This will be important in later steps.

We can confirm that the Access Rule is in place and also confirm that packet monitor is enabled (see the Packet Monitor column within the access rule).

Step 2: Go to the Packet Monitor page via System | Packet Monitor and select Configure. Navigate to Monitor Filter and select Enable firewall based on the firewall/app rule:

Note: No further information is needed because the traffic will be captured when the Access Rule is triggered. Entering any data into the monitor filter will only narrow down the traffic results.

Step 3: Select OK and click Start to capture.

How to Test:

Using a browser, access the IP address or FQDN that was recently added to the access rule. Our example blocks 1.1.1.1.

Notice that the traffic was blocked and also the internal IP address of where the traffic originated from.