Zone protection show wrong severity

L1 Bithead

Zone protection show wrong severity

We are doing a lab and making test attacks and see if the PA can detect them, we have an interface in tap mode and it is doing the span, we did all the configurations in a PA-200 but when we lunch brute force attacks or sql injection,  the logs shown in the "threat" section appears "informational" for the severity column when it should appear another type of severity 

what can be causing this issue ?


L7 Applicator

Re: Zone protection show wrong severity


This has to do with you being in TAP mode. You can't take action on a threat when in TAP and therefore the vulnerabilities that are identified are 'informational' as to alert you that an action wasn't taken. On alerts not identified across TAP interfaces the severity would show accordingly. 

L1 Bithead

Re: Zone protection show wrong severity

Great, thanks for the responde

by any chance, do you have any reference to this, any documentation? for future reference 

you know

thanks in advice !

Community Team Member

Re: Zone protection show wrong severity

Hi @RCastro,


The following page repeats what BPry says :




It doesn't exactly say that all alerts are 'informational' but it does say that the firewall is not able to take action, such as block traffic or apply QoS traffic control when in TAP mode.


Cheers !


Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!