Azure Firewall logs not showing the network rule name

Atanu Gupta 141

Is there anyway to show the network rule name in the output

I have read that this has been added in the preview release and followed the configuration to enable that from the documentation https://video2.skills-academy.com/en-us/azure/firewall/firewall-preview

Although its showing as the feature is installed but still the logs are not showing the effect. Any help would be highly appreciated.

1 answer

GitaraniSharma-MSFT 49,486 Reputation points Microsoft Employee

2022-08-04T18:54:47.87+00:00

Hello @Atanu Gupta ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that Azure Firewall logs for you is not showing the network rule name even after enabling the Network Rule name Logging preview feature via Azure PowerShell.

By default, network rules do not show the name of the rule that is being hit. This needs to be enabled via PowerShell by registering the "AFWEnableNetworkRuleNameLogging" preview feature, which you have already done.

But for the feature to immediately take effect, an operation needs to be run on the firewall. This can be a rule change (least intrusive), a setting change, or a stop/start operation. Otherwise, the firewall/s is updated with the feature within several days.
Refer : https://video2.skills-academy.com/en-us/azure/firewall/firewall-preview#network-rule-name-logging-preview

Did you run any operation on the Firewall for this feature to take effect? If not, please try to perform a simple operation on the Firewall and check the logs again.

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.
Atanu Gupta 141 Reputation points

2022-08-05T04:52:30.93+00:00

Hello, Thanks for the response.

Yes ! I understand that the configuration do not take effect immediately. I have read that section in the doc as well and did (tried out) some configuration changes on the firewall.

Added a delete lock on the firewall.

Modified one Network Rule collection

Configured one firewall policy to export its activity logs to a log diagnostic workspace

Aren't these enough or something more needs to be done. Please advise.

Note: When you say several days; it's tentatively how many days? 4 days already passed here in my case.

GitaraniSharma-MSFT 49,486 Reputation points Microsoft Employee

2022-08-05T11:30:19.717+00:00

Hello @Atanu Gupta ,

Thank you for the update.

There has to be a PUT operation on the Azure Firewall for the feature to take effect.

I would recommend you to change an existing network/application rule or add a dummy rule and then delete it (OR) change a setting such as set DNS setting to enabled in the Firewall etc.

If this doesn't help, we may need to look into your backend logs and need access to your resources for further investigation. Hence, if you have a support plan, I request you file a support ticket, else please do let us know, we will try and help you get a one-time free technical support.

Regards,
Gita

GitaraniSharma-MSFT 49,486 Reputation points Microsoft Employee

2022-08-12T15:16:24.607+00:00

Hello @Atanu Gupta ,

Could you please provide an update on this post?

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Atanu Gupta 141 Reputation points

2022-08-13T04:02:40.05+00:00

Hi,

Thanks...It somehow worked but not as per my requirement. I can see the network rule names for the classic rules only but not for the firewall policies level. Please see my settings below.

4 polices attached to the Firewall service and each policy has its respective application rules defined

Each policy has log analytics workspace configured as well.

The parent firewall also has log analytics workspace configured

But still when I run the following log analytics query, i do not see any application rules getting logged. The network rules are also the native firewall classic rule and not from the policies.

What am I missing. Please advise. Thanks in anticipation.

Atanu Gupta 141 Reputation points

2022-08-17T03:48:38.377+00:00

Your early response will be much appreciated.

KapilAnanth-MSFT 44,556 Reputation points Microsoft Employee

2022-08-17T14:59:09.39+00:00

Hello @Atanu Gupta ,

Thanks for the update.

I tried to replicate the issue from my end, and I am able to see the Rule name for both Firewalls (one with a Policy and one without a Policy associated with it).

Similarly, for an Application Rule, I can see the rule names.

You have mentioned that you have multiple firewall Policies attached to the Firewall service.
Please note that you are referencing the Firewall "Manager"

Also, I see you have enabled Diagnostic settings in the Firewall to which the Policies are attached.

Now, I understand you are able to see the name of the Rules (Network Rules) as of now.
If this is not correct, let me know and we can look into it.

Answering your query,

If you are not seeing any application rules, it's quite possible that there is a high-priority network rule that is allowing/blocking all the requests before Application Rules can hit.

Hence there are no matches for AzureFirewallApplicationRule.

You can try to simulate traffic to hit any Application rule and make sure if the Firewall logs the traffic or not.

Select a Particular Firewall at Scope and run,
AzureDiagnostics
| where Category == "AzureFirewallApplicationRule"

This will clarify if the ApplicationRules are being hit or not.

Thanks,
Kapil

KapilAnanth-MSFT 44,556 Reputation points Microsoft Employee

2022-08-22T06:44:12.223+00:00

Hello @Atanu Gupta ,

May I know if you got a chance to review my previous comment?

Please let me know if you are facing any challenges or if there are any follow-up questions, I shall be glad to address them.

Thanks,
Kapil

Atanu Gupta 141 Reputation points

2022-08-23T04:36:37.043+00:00

Hello,

Thanks for your response and apology for my late reply.

Could you please see from my screenshots above and confirm that atleast the configurations are done correctly. If not then what have I missed?

Also my firewall classic rule has an "allow all" rule configured. So, do you think this is the reason other application and network rules configured in firewall policies are not getting triggered/logged.

KapilAnanth-MSFT 44,556 Reputation points Microsoft Employee

2022-08-23T13:16:24.233+00:00

Hello @Atanu Gupta ,

Looking at your screenshots, I believe the configuration is fine.
Just make sure the rest of the logs are being sent to the log Analytics workspace (as it's not visible)

Run the query in the Logs section of the Firewall (this should set the scope correctly)

If you have an "Allow-All" rule in Network rules, then Application rules will not be hit

However, you should see logs for the Network Rule collection with action as "Allow"

If feasible, request you to re-configure the log(s) and give it a try once more, please.

Let us know if you face any challenge

Cheers,
Kapil

Atanu Gupta 141 Reputation points

2022-08-23T14:39:41.637+00:00

Thanks for your reply. Will update you shortly..
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure Firewall logs not showing the network rule name

1 answer

Your answer