topic Re: session end reason threat in General Topics

session end reason threat

MP18 — Wed, 28 Aug 2019 23:32:04 GMT

We have vendor traffic coming to PA and session end reason is threat.

Under threat i can see the threat id number

They are lot of them

For easy way I have disabled the security profile vulner protection for that rule.

Need to confirm by doing this PA should not end the session with threat right?

Re: session end reason threat

Chacko42 — Thu, 29 Aug 2019 10:48:32 GMT

@MP18 If one of the security-profiles noticed a threat, you configured to be blocked, that is the behavior what you want a NGFW to perform - everything alright.

You should validate, which threat-ids are generated and if these are false-positives or real threats.

I would not recommend to disable security-profiles on production traffic