topic Re: Disabled policy rules in General Topics

Disabled policy rules

sib2017 — Tue, 24 Nov 2015 15:29:49 GMT

Hi,

Under monitoring , still disabled policy rules matching to some some session .
And the session status are most of them 'incomplete' .
Why ?
Thanks

Re: Disabled policy rules

pulukas — Tue, 24 Nov 2015 23:32:00 GMT

This article gives the full definitions for incomplete status. Basically, there is either not a full tcp handshake or not enough data to identify the flow.

https://live.paloaltonetworks.com/t5/Management-Articles/Not-Applicable-Incomplete-Insufficient-Data-in-the-Application/ta-p/65711

Re: Disabled policy rules

gtomte — Wed, 25 Nov 2015 06:41:06 GMT

Are you saying traffic is matching disabled rules?

Re: Disabled policy rules

reaper — Wed, 25 Nov 2015 08:56:08 GMT

disabled rules are not active in the system, this can be seen through the following command:

> show running security-policy

If the disabled rule is at the bottom of the policy it could be that the incomplete session "hits" these for logging purposes

What happens is that the system accepts a syn packet and starts building up a session once the syn packet is allowed to pass throught

If then the session is disrupted, the process of properly building the session and matching an appropriate App-ID and security policy fails and the session is discarded. The system then will still create a log entry and will need to have a 'rule' but since the session was disrupted before a security policy was properly matched, it will not have a proper security policy to add to the log. it can either use a security policy that was matched for the initial handshake, or if it matched an implied rule, one of the last rules in the policy.

tom