topic Re: Different Actions for Security Rules in General Topics

Different Actions for Security Rules

Nikko — Thu, 11 Feb 2021 04:31:59 GMT

Hi Guys,

I would like to know what are the difference between the following actions in the security rules for PA.

1. Deny

2. Drop

3. Reset-client

4. Reset-server

5. Reset-both

Which of these are the most preferred to use? Is deny or drop action also resets the connection for both server and client?

Thanks

Re: Different Actions for Security Rules

kiwi — Thu, 11 Feb 2021 10:58:25 GMT

Hi @Nikko ,

Here are all actions explained:

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/security-policy/security-policy-actions.html

Cheers !

-Kiwi.

Re: Different Actions for Security Rules

jdelio — Thu, 11 Feb 2021 16:26:37 GMT

@Nikko You asked:

"Which of these are the most preferred to use? Is deny or drop action also resets the connection for both server and client? "

Answer:

It really depends on what you are wanting to do. If this is normal traffic, then a Deny would be fine.

If this is traffic that you would want the remote end to not "get a response" , then you would use Drop.

as far as the reset.. the note states:

A reset is sent only after a session is formed. If the session is blocked before a 3-way handshake is completed, the firewall will not send the reset.

I hope this helps.

Re: Different Actions for Security Rules

Kamron — Mon, 03 Jan 2022 20:39:12 GMT

If no Deny Action is listed, the packets will be silently discarded. Drop-reset will discard the session's packets and send a TCP RST packet to let the client know the session has been terminated so it can gracefully close the session locally. In case the session is UDP or ICMP based, an ICMP Unreachable will be sent

Re: Different Actions for Security Rules

Justin468 — Tue, 23 Feb 2021 11:40:48 GMT

@iMessage PC wrote:
Hi Guys,
I would like to know what are the difference between the following actions in the security rules for PA.
1. Deny
2. Drop
3. Reset-client
4. Reset-server
5. Reset-both
Which of these are the most preferred to use? Is deny or drop action also resets the connection for both server and client?
Thanks

Relies upon what you are needing to do. On the off chance that this is typical traffic, at that point a Deny would be fine. On the off chance that this is traffic that you would need the far off finish to not "get a reaction" , at that point you would utilize Drop.