when creating a profile choosing block action is seen as "reset-both" on the logs.
is that normal behaviour or not ? Thanks.
Solved! Go to Solution.
This is an expected behavior. In this case, the PAN firewall blocked that Vulnerability and send TCP RST packet to both parties ( Server and client) to close the connection.
PA should probably update the help file for these vulnerability options. The wording is ambiguous and I assume that block was a drop and not a reset action.
Choose the action (Alert, Allow, Default, or Block) to take when the rule is triggered. The Default action is based on the pre-defined action that is part of each signature provided by Palo Alto Networks. To view the default action for a signature, navigate to Objects > Security Profiles > Vulnerability Protection and click Add or select an existing profile. Click the Exceptions tab and then click Show all signatures. A list of all signatures will displayed and you will see an Action column.
As per the screenshots attached in this discussion thread, the firewall identifies the vulnerability with threat ID: 35107
If you check the default action of this Vulnerability signature, is to reset the connection.
Hope this helps.
But PanLst is choosing "Block" not "Default" for the action.
The help file does not specify which action occurs with "Block" drop or reset. Are you saying above that the action is reset both?
My apologies, i understand it wrongly. You are correct, As per the DOC: Vulnerability Profile Actions if traffic is hitting this vulnerability-protection rule, it should simply drop all packets for that session.
Could you please provide a snapshot of the traffic logs and security rule, just to confirm the vulnerability rule "ALL" applied to the correct policy.
The default action is defined by Palo Alto Networks on a per-threat basis as either alert or block.
Every vulnerability has a "block" behavior. Some block behaviors send a reset to the server or client, or in this case, both. For this example the default action is block, and the block behavior is reset-both. Even though the action being taken is block, the threat log will show the block behavior that was used to terminate the session under the action column.
If you want to change the "block" behavior for a threat, you must configure an exception.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!