Action Configured in Security Rules and Seen in Traffic Log is Inconsistent 7.04

cancel
Showing results for 
Search instead for 
Did you mean: 

Action Configured in Security Rules and Seen in Traffic Log is Inconsistent 7.04

L4 Transporter

Since upgrading to 7.0.4 our traffic logs now show the action of 'reset-both' and 'deny' when the rule explicitly has been set to 'deny'. This is occuring on multiple rules since upgrading from 6.1.8.

 

Example: we have a rule to block specific applications like bittorent, http-proxy, hola-unblocker, etc and the action is set to 'deny'. But now we see a mixture of 'deny' and or 'reset-both' for this rule. Before upgrading to 7.0.4 the action was always 'deny' as this is how the rule was setup

 

Is this to be expected? If so is there somewhere to read the explination?

1 ACCEPTED SOLUTION

Accepted Solutions

L4 Transporter

I just received notifaction from support indicating although the action is set to deny in the policy the actual action can be different.

 

https://www.paloaltonetworks.com/documentation/70/pan-os/newfeaturesguide/networking-features/granul...

 

 

action.JPG

View solution in original post

6 REPLIES 6

L7 Applicator

Do you have a security profile attached to the rule?

 

I'm wondering if that traffic may be hitting a threat id that has an action for reset both.

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center

Cyber Elite
Cyber Elite

@lewishttps://downloads.paloaltonetworks.com/software/PAN-OS-7.0.4-RN.pdf?__gda__=1452055432_eb7de8c610922...

 

 

Under Changes to Default Behavior

 

"The default actions for handling threats now are alert or reset-both (sides of the connection). In releases prior to PAN-OS 7.0.0, the defaults were alert or block. On upgrade, the block action will be converted to reset-both; and the drop-packets option is now renamed as drop."

 

I looked at out "Application Deny Rule" which has no security profiles just the "deny" action selected and we've got "Reset-Both" as the action.  So I guess it's just not a "threat" but for any "Deny."  With the "drop" action now available.  I'm guessing that selecting "Deny" is going to be the same as selecting "reset-both."

this was a part of my initial thinking too as we do have security profiles associated to the rules. However under further invesigation the traffic in question is not associated to any threat signatures.

Thanks Brandon_Wertz. I will have a look at this

I have since logged a ticket with support and they are still investigating as a possible bug as the action should only match what the policy is set too.

L4 Transporter

I just received notifaction from support indicating although the action is set to deny in the policy the actual action can be different.

 

https://www.paloaltonetworks.com/documentation/70/pan-os/newfeaturesguide/networking-features/granul...

 

 

action.JPG

View solution in original post

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!