topic Opened session remains after threat triggered block-ip. WTF! in General Topics

Opened session remains after threat triggered block-ip. WTF!

ACortes — Thu, 09 Feb 2017 13:07:31 GMT

Hi, I've been testing the block-ip action in spyware DNS signatures. I was an RDP session before the threat triggered the block-ip action. Then, no more connections are allowed (what is OK), but the RDP session remains open.

Is this a normal behaviour? I think the FW should reset all the sessions previosly established for the blocked IP, shouldn't it?

Thanks!

Re: Opened session remains after threat triggered block-ip. WTF!

reaper — Thu, 09 Feb 2017 14:38:21 GMT

with the block-ip action set, the malicious session will be terminated and any new sessions will be blocked before they are created, but existing sessions could remain open as they were established before the malicious event.

scanning on this active session will continue and if any malicious packets are identified in that session, it will also be terminated