Security Policy action is "allow", but session end reason is "policy-deny"

Highlighted
L6 Presenter

Security Policy action is "allow", but session end reason is "policy-deny"

Hi All,

 

l think l  am missing something fundamental.  l have a policy with  "allow" action, but in the traffic logs session end reason is "policy-deny" :

 

policy-deny.PNG

 

Despite all this, l am still able to access the server:

 

SEC.PNG

L4 Transporter

Re: Security Policy action is "allow", but session end reason is "policy-deny"

Hi @TranceforLife

According to this new feature guide, since PAN-OS 6.1 the "policy-deny" reason, is because the session matched a security policy with a deny or drop action.

https://www.paloaltonetworks.com/documentation/61/pan-os/newfeaturesguide/networking-features/sessio...

In other words, the app-id or port being hit, does not match an explicity policy; hence, it is most likely hitting the interzone-default policy.

By the way, the interzone-default policy (at the bottom of the rule base) is not logged by default; however, you can override this configuration.

 

Default Interzone Policy:Interzone-default-nooverride.PNG

 Default Interzone Read-only:Interzone-default-nooverride-readonly.PNG Default Interzone default action:Interzone-default-nooverride1.PNG

 

 Override Default Interzone-PolicyInterzone-default-nooverride.PNG

 Note: Click the Override button at the bottom of the screen

 

 

 

Change Default Interzone default action:Interzone-default-override-write1.PNG

 

 The reason I want to log the session at the start is because the action is "Deny" or "Drop", and I don't care about having the full session view in this case. In other words, as soon as the traffic is denied, a log is generated right away and not only at the end of the session. I hope it makes sense.

 

Now to your original question, my point is that the policy-deny reason you are seeing is because the app-id or port is not explicitly placed in an allow policy; hence, it will hit the default deny (Interzone) policy, which is not logged by default, as I stated before.

 

I hope this helps.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Tags (1)
L7 Applicator

Re: Security Policy action is "allow", but session end reason is "policy-deny"

@TranceforLife

  • Are you on 8.0.x or 7.1.x?
  • Do you see these specific logs only with decrypted sessions?

If you can answer these questions with yes

--> Read my last post in this topic: https://live.paloaltonetworks.com/t5/General-Topics/Action-and-Session-End-Reason-conflict-when-SSL-...

(It is at least very likely that you see the same "issue")

L4 Transporter

Re: Security Policy action is "allow", but session end reason is "policy-deny"

@Willian if the traffic was hitting their interzone-default, wouldn't the log reflect that?  It would appear that it is hitting a security rule that they've set up with the name "OUT".

 

I think @vsys_remo may be correct in that it is related to the decryption.

 

I've also seen in my testing where SSL is decrypted into "web-browsing" and is then denied because it is going across 443 instead of 80 if the rule was set to application-default.  While I'm not suggesting that is happening here (it looks like it is still showing it as SSL traffic), decryptiong seems to add some potential complexity to the security policy design.

L7 Applicator

Re: Security Policy action is "allow", but session end reason is "policy-deny"

I have just upfated the other post with the newest TAC reply ... but as this seems to me still like the same issue :
"The issue is due to a current limitation in identifying session end reasons with SSL code values, which is expected to be fixed in the upcoming maintenance releases (ETA unknown). As of now, the session-end-reason is working as designed and uses the generic "policy-deny" for certain failure condition."
L7 Applicator

Re: Security Policy action is "allow", but session end reason is "policy-deny"

@jsalmans,

There is a lengthy on-going discussion on how to properly address the 'web-browsing' issue when using SSL decryption. As of Ignite17 to recommended soution is still to enable a browsing rule with web-browsing using a specified tcp-443/80 service instead of application-default.

 

 

L6 Presenter

Re: Security Policy action is "allow", but session end reason is "policy-deny"

Hi All,

 

Thanks for all your input.

@vsys_remo yes 8.0.3 and yes exactly the same issue as yours (initially I thought l missed some fundamentals :D)

Kudos for all replies!!

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!