topic Re: Vulnerability Signature action is Alert but traffic is getting reset both due to threat in General Topics

Vulnerability Signature action is Alert but traffic is getting reset both due to threat

MP18 — Thu, 05 Sep 2019 02:23:48 GMT

In PA traffic is blocked due to threat signature.

In threat kogs it shows reset both.

When i check the signature it shows default action is alert only???

Why PA is resetting the connection when signature shows action as alert only???

Re: Vulnerability Signature action is Alert but traffic is getting reset both due to threat

reaper — Thu, 05 Sep 2019 10:39:10 GMT

Have you checked the security profile that is being hit? The default action for a specific signature may be alert, but the profile can be set to, for example, reset both on (all) high severity threats

Re: Vulnerability Signature action is Alert but traffic is getting reset both due to threat

MP18 — Fri, 06 Sep 2019 23:00:04 GMT

Yes check the security profile it shows if alert is high then action is reset.

Why is this behaviour?

Re: Vulnerability Signature action is Alert but traffic is getting reset both due to threat

reaper — Sat, 07 Sep 2019 20:02:17 GMT

This is how the administrator configured the profile