Traffic log action shows allow but session end shows threat

PPradhan — Wed, 27 Jul 2022 05:01:03 GMT

I need to know if any traffic log is showing allow and if the session end reason is showing as threat than in that case the traffic is allowed, or it's blocked, and also I need to know why the traffic is showing us threat.

Re: Traffic log action shows allow but session end shows threat

PavelK — Wed, 27 Jul 2022 10:30:50 GMT

Hello @PPradhan

this KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HCQlCAO gives best answer. In nutshell, the log is showing as allowed as it is not blocked by security policy itself (6 tuple), however traffic if processed further by L7 inspection where it is getting block based on threat signature, therefore this session is in the end blocked with end reason threat.

Kind Regards

Pavel

topic Traffic log action shows allow but session end shows threat in Next-Generation Firewall Discussions

Traffic log action shows allow but session end shows threat

Re: Traffic log action shows allow but session end shows threat