topic Re: AIOPS inaccurately reports on QUIC BPA Block in AIOps for NGFW Discussions

AIOPS inaccurately reports on QUIC BPA Block

JoshuaBowers — Thu, 09 Mar 2023 14:52:57 GMT

I blocked QUIC within panorama shared policy last week. AIOPS still recommends blocking QUIC. How do I get AIOPS to recognize that we are blocking QUIC with an App group? I can't create a ticket as the ticket platform keeps shoving me to the LIVE community. I don't think anyone here is able to help as this seems like a parsing issue on AIOPS.

Re: AIOPS inaccurately reports on QUIC BPA Block

Grant_Peterson — Thu, 09 Mar 2023 16:46:02 GMT

Seems like the AIOPS QUIC blocking check is pretty explicit, that a rule is first in list and has application quic. It likely doesn't match on it being in an app group, or further down the list. When I added a quic block rule, it reported as unresolved until i moved it to the top of the other allow rules

'It is recommended to have a security rule with application = 'quic' and action != 'allow' before any allow rules to ensure encrypted traffic is decrypted and inspected'

I am also keen to understand the Palo Alto support model for AIOPS. Even though we have the 'Free' version, you have to spend a lot of money on the firewalls themselves to get it, so not really free, some support would be nice.

Re: AIOPS inaccurately reports on QUIC BPA Block

JoshuaBowers — Thu, 09 Mar 2023 16:48:02 GMT

I want to use an APP group so I don't have 2+ rules doing the same thing. AIOPS should be able to parse it.

Re: AIOPS inaccurately reports on QUIC BPA Block

Grant_Peterson — Thu, 09 Mar 2023 16:55:34 GMT

I have similar issues with the Malicious URLs EDL recommendation, where if I use my own EDL with exceptions it doesn't meet the BPA recommendation.