Firewall Live View filtering

[lshantz]

Something has either broken or changed.

The live view is an incredibly useful troubleshooting log because I was able to filter on Interface port and even down to an IP address. Filtering by IP address allows me to view a particular device I'm having issues with.

All of a sudden since the last update, (possibly the one before the last one) I can no longer filter on IP address. it ignores the filter and shows all.

Is this a bug that was introduced or has the way it worked changed?

[mimugmail]

The UI changed with 20.1.8. The default search condition is "Action", just check the dropdown field

[lshantz]

I saw that, but I can't seem to figure it out. For instance. Say I want to ONLY see one IP address.

Let's say it is 192.168.1.12 and it is on interface LAN. I would think the default of "action" "contains" with the IP address typed in, should yield the desired results no? If I click the + sign, it drops it down to a little box and NOTHING shows. Is it the UI is confusing, or is it borked?

[gpb]

For IP addresses I think only SRC or DST are valid, not "action".  Action I think is for allow, reject and block but using those words doesn't filter anything...not sure what valid values for Action are.

Edit: "pass" is one of the valid actions.  Clicking the "i" to the right of each line probably reveals other valid values.

[cguilford]

change to SRC and Contains whatever ip should get what you want

[lshantz]

Okay, kind of sort of works like the old way. I'm sure this is far more granular. Just not very intuitive. Thanks much

[franco]

Ironic, a number of people complained it wasn't intuitive before. Some found it not flexible. It's hard to get this right for everyone I guess...

That being said, it might be nice to have a select box if the filter is actually a fixed set of values just to make it more clear and less error-prone.


Cheers,
Franco

[lshantz]

HA! That is the rub. You can't please all people all the time. The tip you gave me DID help and I'm almost making it work now. It may be buggy still since it is a recent roll out? I still have the static log I can use and packet traces, so all is good.

[siga75]

I would just add:

• OR clause, the default is and harcoded AND
• generic host, that can be both src or dst (just like tcpdump)
• filter on rule description (the content not the rule ID)

Another issue I have is I usually flag the resolve DNS box, which means I have no IP to use as a filter, maybe a tooltip on the DNS field that show the actual IP address

[Simser]

To make basic filtering fast and easy again, I would just add "any" in the first dropdown, which works just like the old filter, and make it default. If someone wishes advanced filtering, then they could use the dropdowns.

[d0zr]

+1 to that, the options aren't immediately clear, once you realise how to use the parameters, it works. 

IIRC the filter dialogue popped over the list, so hard to reference the columns (or maybe they were blank at the beginning), so made it a bit harder when choosing what to filter.

Needs a few of the options in the dialogue, and/or the help.