topic Re: Creating Data Filtering Profile in PA in Next-Generation Firewall Discussions

Creating Data Filtering Profile in PA

PPradhan — Tue, 26 Jul 2022 05:20:28 GMT

Hi,

I am creating a data filtering profile and I want to only allow alert threshold, not to block, so I need to know how much value to add inside.

Re: Creating Data Filtering Profile in PA

PavelK — Tue, 26 Jul 2022 06:02:52 GMT

Hello @PPradhan

could you refer to this KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CldCCAS

In nutshell, set the Block Threshold to 0 and Alert Threshold to non zero value. Alert Threshold tells firewall if it sees a data pattern X number of times within the same session to generate an alert. I would start with value 2 or 3 and tune it up if necessary.

Kind Regards

Pavel

Re: Creating Data Filtering Profile in PA

PPradhan — Tue, 26 Jul 2022 06:52:46 GMT

Hi PavelK,

I have created data patterns profile and data filtering profile and keep threshold alerts to 20, block to 0 and severity to low and added inside the security rule.

>> In monitor > Data Filtering tab I can see the logs are coming and its showing alerts so in that case the traffic is not blocked?

Re: Creating Data Filtering Profile in PA

PavelK — Tue, 26 Jul 2022 07:28:51 GMT

Thank you for reply @PPradhan

this is correct. Alert means traffic is allowed, only log is generated. Here is a reference to the documentation: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/security-profiles#id6272be37-1ce2-4374-a431-bfb1db9da9e0_id6a5c6acd-528f-448b-ba83-8a6e1b114a05

Kind Regards

Pavel