topic Problem with HTTP request parameters in FirePower log messages in Network Security

Problem with HTTP request parameters in FirePower log messages

bob.jensen — Fri, 21 Feb 2020 15:05:11 GMT

Hi everyone,

For example we make a HTTP(S) request through FirePower, something like this:

GET test.site.com/search?text=TEST

however URL field in log line will contain only test.site.com, without request parameters or even a path. But in next requests we will see our full request in Referer field)

Is there is way to fix this? Since many other firewalls, proxies, UTMs handle this properly, I hope that should be a solution.

Re: Problem with HTTP request parameters in FirePower log messages

er.shivamdubey31190 — Tue, 09 Jan 2018 12:32:44 GMT

Hi Bob,

Hope you are doing good.

Please clarify that what exactly you want to achive.

1 -Do you wanna see every detail in log line (i.e. along with the request parameters and path ) OR

2 - You dont wanna see " full request in Referer field"

Answering the first concern, Firepower make use of pre-processors, which are used to normalize traffic of each protocol and then forward it for inspection to the inspection engine, so that it becomes smooth for inspection engine to inspect the traffic. So I belive, if you are see the HTTP request traffic in the manner you described, it shall be due to pre-processor behaviour.

I am also curious to know that this how is this behaviour is leading any problem.

Shivdbe

EX Cisco-TAC

Re: Problem with HTTP request parameters in FirePower log messages

bob.jensen — Tue, 09 Jan 2018 16:36:29 GMT

Thank you for reply.

I want to see full HTTP(S) GET request URL with parameters. For example we have request like this:

https://site.com/search/?query=MY+REQUEST

This is how it looks like in Squid log(with HTTPS inspection):

1515252780.448 786 192.168.0.233 TCP_MISS/200 67620 GET https://site.com/search/? - HIER_DIRECT/- text/html /search/?query=MY+REQUEST 1311 ""

as you can see there is a separate field with URL path and parameters, however it can be configured to store whole URL in one field.

With FirePower I cant achieve this, I get only domain name in URL field in log messages, i.e. in the example above I will get only this:

URL: https://site.com

PS: In FirePower I have configured SSL policy with Decrypt - Resign action.