Issue with Connection being Categorised as a Threat

JonHill — Fri, 20 Oct 2023 09:22:19 GMT

For the past 5 or 6 days I've suddenly started getting a connection to a Palo GUI categorised as a threat, this worked previously without issue.

When I've looked at the traffic logs it shows source and destination as correct but under the PCAP it says that the URL - 90.4.19.156 is blocked as medium risk\unknown, see below.

I'm a bit flumoxed as to why in the log detail is correct but the PCAP shows a totally different destination.

If anyone could give any advice on how to tackle this issue it would be much appreciated.

Thanks

Jon

Re: Issue with Connection being Categorised as a Threat

akuzhuppilly — Mon, 23 Oct 2023 03:03:54 GMT

Hello @JonHill

Are you using the firewall management interface IP to access the GUI, or are you employing a URL with local DNS resolution?

topic Re: Issue with Connection being Categorised as a Threat in General Topics

Issue with Connection being Categorised as a Threat

Re: Issue with Connection being Categorised as a Threat