Logs and Reporting - Views

[russjstewart]

Hi, I thought I would try here before logging a support call in the hope someone else has seen my problem.

I am trying to create a view that will show me which internal hosts are having connections blocked at the firewall as they try to access the Internet or access another zone on the firewall,

I have created a view with the following filter

Action Equals Drop,Reject,Block
Source Equals 172.22.34.62

and table Widget showing Destination up to 11 values and Destination Port up to 11 values and everything default. My problem is that I am only seeing 3 destination all of which are in other zones on the firewall and no destinations on the Internet. When I look a the log messages I can seeing blocked traffic going to the Internet.

Anyone have any ideas please?

[EricAnderson]

If I understand you correctly, I'd think a query string like this should do the trick. You'd just need to replace "Internal_Networks" with a group containing all destinations you want excluded, or you could replace it with an "OR" list in parentheses:

source:172.22.34.62 AND (action:drop OR action:Reject OR action:Block) NOT destination:Internal_Networks

or

source:172.22.34.62 AND (action:drop OR action:Reject OR action:Block) NOT (destination:excluded1 OR destination:excluded2 OR destination:excluded3)

Am I missing something?

-E