topic Zone protection show wrong severity in General Topics

Zone protection show wrong severity

RCastro — Fri, 02 Feb 2018 19:08:38 GMT

We are doing a lab and making test attacks and see if the PA can detect them, we have an interface in tap mode and it is doing the span, we did all the configurations in a PA-200 but when we lunch brute force attacks or sql injection, the logs shown in the "threat" section appears "informational" for the severity column when it should appear another type of severity

what can be causing this issue ?

Re: Zone protection show wrong severity

BPry — Fri, 02 Feb 2018 20:27:11 GMT

@RCastro,

This has to do with you being in TAP mode. You can't take action on a threat when in TAP and therefore the vulnerabilities that are identified are 'informational' as to alert you that an action wasn't taken. On alerts not identified across TAP interfaces the severity would show accordingly.

Re: Zone protection show wrong severity

RCastro — Tue, 06 Feb 2018 15:50:59 GMT

Great, thanks for the responde

by any chance, do you have any reference to this, any documentation? for future reference

you know

thanks in advice !

Re: Zone protection show wrong severity

kiwi — Tue, 06 Feb 2018 15:55:52 GMT

Hi @RCastro,

The following page repeats what BPry says :

tap-mode-deployments

It doesn't exactly say that all alerts are 'informational' but it does say that the firewall is not able to take action, such as block traffic or apply QoS traffic control when in TAP mode.

Cheers !

-Kiwi