vulnerability block action

Reply
Highlighted
L3 Networker

vulnerability block action

Hi,

when creating a profile choosing block action is seen as "reset-both" on the logs.

is that normal behaviour or not ? Thanks.

just_one_rule.png

logsrelated.png

Tags (2)
L7 Applicator

Re: vulnerability block action

Hello Panlst,

This is an expected behavior. In this case, the PAN firewall blocked that Vulnerability and send TCP RST packet to both parties ( Server and client) to close the connection.

Thanks

L7 Applicator

Re: vulnerability block action

PA should probably update the help file for these vulnerability options.  The wording is ambiguous and I assume that block was a drop and not a reset action.

Action

Choose the action (Alert, Allow, Default, or Block) to take when the rule is triggered. The Default action is based on the pre-defined action that is part of each signature provided by Palo Alto Networks. To view the default action for a signature, navigate to Objects > Security Profiles > Vulnerability Protection and click Add or select an existing profile. Click the Exceptions tab and then click Show all signatures. A list of all signatures will displayed and you will see an Action column.

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center
L7 Applicator

Re: vulnerability block action

Hello Panlst,


As per the screenshots attached in this discussion thread, the firewall identifies the vulnerability with threat ID: 35107


Vulnerability-reset-action-1.jpg

If you check the default action of this Vulnerability signature, is to reset the connection.


Hope this helps.


Thanks

L7 Applicator

Re: vulnerability block action

But PanLst is choosing "Block" not "Default" for the action.

The help file does not specify which action occurs with "Block" drop or reset.  Are you saying above that the action is reset both? 

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center
L3 Networker

Re: vulnerability block action

but we choose block not default.There is something wrong here.Block = reset both

L7 Applicator

Re: vulnerability block action

Hello Panlst,

My apologies, i understand it wrongly. You are correct, As per the DOC: Vulnerability Profile Actions  if traffic is hitting this vulnerability-protection rule, it should simply drop all packets for that session.

Could you please provide a snapshot of the traffic logs and security rule, just to confirm  the vulnerability rule "ALL" applied to the correct policy.

Thanks

L6 Presenter

Re: vulnerability block action

Hi HULK;

I replicated that.

Here are the screens.I think there is something wrong with definitions or explanations.

4.png

3.png2.png1.png

L4 Transporter

Re: vulnerability block action

The default action is defined by Palo Alto Networks on a per-threat basis as either alert or block.

Every vulnerability has a "block" behavior.  Some block behaviors send a reset to the server or client, or in this case, both.  For this example the default action is block, and the block behavior is reset-both.  Even though the action being taken is block, the threat log will show the block behavior that was used to terminate the session under the action column.

Quick edit:

If you want to change the "block" behavior for a threat, you must configure an exception.

L6 Presenter

Re: vulnerability block action

Thanks for answer.

So block behaviour should be added somewhere on the guides as definiton also I think.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!