topic Re: Adding Threat Exceptions in General Topics

Adding Threat Exceptions

phild — Tue, 16 Apr 2013 10:49:09 GMT

Hi, I wonder if somebody can help me with a query?

I am running a 2050 as my firewall (I am new to looking after Palo Altos!). I have colleagues building workstations at another site coming across a VPN to access resources at my site. The router and links are working fine.

One particular application is not getting through and is being blocked as a threat. The entry in the log is:
SIP CSeq Header Field Integer Overflow

ID: 31788

Severity: HIGH

Description:

Several SIP based products are prone to an integer overflow while handling crafted requests containing invalid sequence numbers in CSeq header field. An attacker could exploit the vulnerability by sending a crafted request containing margin integer values in CSeq header. A successful exploit could lead to remote code execution or crash the server.

I have the option Add to Threat Exception which I would like to press to see if it fixes my problem. Before I press the button I would like to know where this exception is stored and how can I remove it if I want to reinclude it?

Going forward can I create a policy which only allows it through if it is coming from s specific IP subnet?

Any questions then let me know.

Regards,

Phil

Re: Adding Threat Exceptions

emr_1 — Tue, 16 Apr 2013 11:09:33 GMT

Hi Phil,

Sounds PANOS 5.0 would be nice for you.

The detail of threat log looks as below on 5.0.4.

You can select profile and also you can use Exempt IP address (this is new from 5.0)

Regards,

Emr

Re: Adding Threat Exceptions

phild — Tue, 16 Apr 2013 11:16:05 GMT

Hi EMr,

Thanks for your quick reply. We did install 5.0.4 but it appeared to cause problems with our internet connectivity (This is still being looked at by PA) so we reverted back to 4.x

Do you know where the exception is stored if I press the Add Threat Exception button and whether it is possible to undo it?

Phil

Re: Adding Threat Exceptions

emr_1 — Tue, 16 Apr 2013 11:34:22 GMT

You can choose profile even you run 4.1

The following doc might help you.

How to Tune IPS in PAN-OS 4.1

This also might help you.

Regards,

Emr

Re: Adding Threat Exceptions

craymond — Tue, 16 Apr 2013 14:15:56 GMT

You need to create a separate Vulnerability protection profile for the policy rules that you want to make exceptions for, as the exceptions are applied to the Vulnerability protection Profile. If you want it to be excepted from all rules, just except it from your generic Vulnerability protection profile.