topic Vulnerability Protection Profile in Advanced Threat Prevention Discussions

Vulnerability Protection Profile

DCleve — Wed, 06 Sep 2023 20:39:35 GMT

Hello!

I have a rule with a vulnerability protection profile enabled between my VPN users and DMZ.

I need to WebGUI (8443/8080) into a new DMZ server, but VP is stopping it.

How do I make an exception for this traffic?

Thanks,

Re: Vulnerability Protection Profile

PavelK — Thu, 07 Sep 2023 03:01:37 GMT

Hello @DCleve

thanks for posting.

I would recommend to review traffic and security logs from: Monitor > Logs > Traffic / Threat to confirm exact reason for traffic to be denied / dropped. If you confirmed that vulnerability signature is causing an issue, here are 2 KBs for applying an exception either on signature or IP address level:

How to create a vulnerability exception

Vulnerability Exception Based Upon Source and Destination IP Address to change the default behavior

If you believe this is a false positive, you can reported: How to Submit a Vulnerability Signature False Positive

Kind Regards

Pavel

Re: Vulnerability Protection Profile

DCleve — Thu, 07 Sep 2023 18:11:12 GMT

Thanks for the reply, PK.

This is strange. The Traffic logs report that the traffic is allowed, but I'm getting nothing but RST, ACK (with no connection), allegedly from the server.

The server, though, shows that it's listening on ports 8080 and 8443. I'm second-guessing my theory that the problem is Vulnerability protection. As I research, APP-ID could also be the problem, but again, all traffic is "allowed" in the traffic logs and isn't present in the Threat logs.

Any help here would be appreciated.

I assumed the problem was vulnerability protection because a profile is attached to the policy, but I see nothing in the traffic or threat logs indicating this.

Re: Vulnerability Protection Profile

PavelK — Thu, 07 Sep 2023 21:51:23 GMT

Hello @DCleve

thank you for reply.

To eliminate assumptions, could you check Unified logs with server's IP address in filter from: Monitor > Logs > Unified? Unified logs have all log types in one screen.

If it is possible could you take a packet capture from server? Also if it is possible could you temporarily take vulnerability profile out of the policy and test connection?

Kind Regards

Pavel