web browsing logging on a watchguard firebox v7

[age]

Hi, I am trying to use the watchguard logging facility to produce a log of all web browsing that the users behind the firewall are doing. I can log this by setting up an http proxy and i can produce a logfile that gives me times, source IP addresses, and target IP addresses.

I can also include url info, so that I would get the following kind of info:

http://192.168.0.1/pages/stuff.asp

I also know that I can include reverse DNS lookups with this, BUT here is the problem... How many websites have a dedicated IP address these days? not many.. so I end up with the ip's resolving to the host names of shared web servers, which is no good...

So, is there a way, within the watchguard firebox software, of accurately logging the url info, so that i get a report showing exactly what people are browsing?

Thanks

Adrian.

 

[stiles123]

The only really effective way to get a report showing accurate internet browsing habits would be to implement some form of Proxy as well as your firewall. This also has the benefit

This needn't be a particularly complex package, but you want something handling HTTP requests and logging this behaviour to a logfile that can be analysed properly.

If you think about it, your firewall logs will have a mixture of IP filtering rules as well as HTTP Proxy rules. You'll end up with huge log files containing either Proxy information useless for security checking or IP filtering info useless for proxy log analysis.