topic Re: Gmail imap traffic allowed but reset as threat in Next-Generation Firewall Discussions

Gmail imap traffic allowed but reset as threat

igor.shpak — Thu, 04 Jul 2024 09:19:54 GMT

Hello everyone,

PA3220, it is already a couple of days as gmail imap traffic is allowed, but connection is reset as threat in Traffic Logs (see attached) Threat logs show nothing.

When checking traffic details, there is a strange app characteristics (see attached)

Any ideas?

Re: Gmail imap traffic allowed but reset as threat

CosminM — Thu, 04 Jul 2024 09:33:17 GMT

Hello @igor.shpak

Session end reason threat can be also from Data Filtering Security Profile and not only from Antivirus, Anti-Spyware or Vulnerability security profiles.

Please check also Data Filtering logs.

Re: Gmail imap traffic allowed but reset as threat

igor.shpak — Thu, 04 Jul 2024 09:40:59 GMT

Hello CosminM,

There is nothing in Data Filtering and URL filtering (sorry, pressed on Accept as Solution button by mistake)

Re: Gmail imap traffic allowed but reset as threat

CosminM — Thu, 04 Jul 2024 09:50:39 GMT

Hello @igor.shpak

Please look into Detailed Log View by clicking on the Traffic Log's magnifying glass icon and check what was the reason to be classified as threat.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HCQlCAO

Re: Gmail imap traffic allowed but reset as threat

igor.shpak — Thu, 04 Jul 2024 09:58:41 GMT

This is what I did in the first place, pls see attached details.jpg from the first post

Basically it says

used-by-malware,able-to-transfer-file,has-known-vulnerability,tunnel-other-application,pervasive-use,is-saas,is-hipaa,is-soc2

Re: Gmail imap traffic allowed but reset as threat

CosminM — Thu, 04 Jul 2024 10:15:18 GMT

I am suggesting you check the entire Detailed Log View information and not only Details section from that view.

What is "Session End Reason: threat"?

Re: Gmail imap traffic allowed but reset as threat

igor.shpak — Thu, 04 Jul 2024 10:18:49 GMT

There is nothing else valuable in Detailed Log View

Re: Gmail imap traffic allowed but reset as threat

igor.shpak — Thu, 04 Jul 2024 10:32:18 GMT

Issue solved, looks like a specific email in gmail mailbox was causing it. After deleting some newly arrived emails from Gmail web, issue was resolved