Configuration of Security Profiles

iscott — Sun, 19 Apr 2020 23:30:28 GMT

Hello,

I have a question related to the actions that I can configure in Security Profile. Specifically, Vulnerability Protection.

What happens if I set the action as "Alert"? Will it drop the connection? Or the connection will be permitted, and it just logs the traffic of the malicious action executed?

Regards,

Re: Configuration of Security Profiles

SutareMayur — Mon, 20 Apr 2020 06:01:32 GMT

@iscott,

If you set actions as "alert" then it won't block/drop connection. It will permit traffic and log that traffic. If you really want to drop specific traffic against any threat/CVE, you need to set action as "drop". Also there are other actions available that you can set. e.g. Block IP, Reset Server/client/both and allow.

There are default actions set for each signature or threat id. You can override these actions as per your requirements.

Hope it helps!

Mayur

topic Re: Configuration of Security Profiles in General Topics

Configuration of Security Profiles

Re: Configuration of Security Profiles