topic Re: Allow and then drop in General Topics

Allow and then drop

jdprovine — Fri, 22 Jan 2016 13:17:48 GMT

I have traffic that is showing up and allowed and dropped. What does that mean?

Re: Allow and then drop

reaper — Fri, 22 Jan 2016 13:21:35 GMT

Could you show us an example through a screenshot ?

It may be that you have logging set to start and end of session and that a connection is first being allowed but later denied due to the application morphing into a blocked app

Re: Allow and then drop

jdprovine — Fri, 22 Jan 2016 13:49:04 GMT

Yes here it is

Re: Allow and then drop

reaper — Fri, 22 Jan 2016 13:58:39 GMT

if you look at the bottom 2 lines, you can see that in the column 'log' you have a threat entry and a traffic entry

this means that the initial dns connection was allowed to go out to the internet, but then a malicious dns query was detected by a security profile (spyware) and blocked.

there are 2 different databases that collect log information regarding a session:

traffic log: this simply records if a tcp connection is allowed through or not by security policy
threat log: this records, independently of the traffic log, if a threat is detected and which action is taken, if any

so it's possible a sssion is allowed through by a security policy, but then after it has aleready started gets blocked because a threat is detected

hope this helps

Tom

Re: Allow and then drop

jdprovine — Fri, 22 Jan 2016 14:10:19 GMT

So as long as the users has spyware on his machine he will continue to back on the door of the PA and then get denied. According to the predefined report the user is number 5 of the top sessions on the PA should I be concerned about that?

Re: Allow and then drop

reaper — Fri, 22 Jan 2016 14:17:06 GMT

If this is a user and you're seeing a lot of threat logs matching his or her IP address, it would certainly warrant you taking a look and running a couple of virus scans on the machine

Re: Allow and then drop

jdprovine — Fri, 22 Jan 2016 14:20:47 GMT

I agree but my helpdesk did not LOL.