topic Re: Question regarding "reset-both" action in Advanced Threat Prevention Discussions

Question regarding "reset-both" action

miyaaccount — Wed, 29 Apr 2020 04:11:00 GMT

I've been seeing alot of Code Executions on Palo Alto Threat logs, most of them are not applicable on our servers and had an action of "Reset-both". Did the Firewall completely blocked the connection or there's a connection happened but did not complete since both server and client had a RST.

Also same on application based, there's a lot of "Reset-both" teamviewer connections on my logs, is it advisable to completely blocked it so it won't appear on my firewall logs?

Re: Question regarding "reset-both" action

reaper — Wed, 29 Apr 2020 07:57:37 GMT

The 'reset-*' action will inject a RST packet into the tcp stream, breaking the connection.

So a connection exists, a threat is detected and blocked, and a RST is sent to end the session

Re: Question regarding "reset-both" action

MP18 — Fri, 08 May 2020 19:21:59 GMT

So in this case PA sends the reset connection to both pc and server at same time right?

Re: Question regarding "reset-both" action

reaper — Fri, 08 May 2020 19:26:55 GMT

for reset-both yes

RST is sent to client and server at the same time

Re: Question regarding "reset-both" action

MP18 — Fri, 08 May 2020 19:29:27 GMT

Many Thanks Reaper need to learn lot from you.

Re: Question regarding "reset-both" action

reaper — Fri, 08 May 2020 19:37:26 GMT

That can be arranged 😉

Re: Question regarding "reset-both" action

MGPIBM — Mon, 27 Feb 2023 14:26:05 GMT

Question trying to resolve a logging issue we are using thresholds to block-ip source our Qradar instance is not seeing the block-ip logs all logging function are functioning properly from our Pano. I was going to turn on log at session start and also considering changing it to see if reset-both would show up. Any thoughts or explanations would be helpful thanks.