- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
01-04-2016 11:00 AM
Since upgrading to 7.0.4 our traffic logs now show the action of 'reset-both' and 'deny' when the rule explicitly has been set to 'deny'. This is occuring on multiple rules since upgrading from 6.1.8.
Example: we have a rule to block specific applications like bittorent, http-proxy, hola-unblocker, etc and the action is set to 'deny'. But now we see a mixture of 'deny' and or 'reset-both' for this rule. Before upgrading to 7.0.4 the action was always 'deny' as this is how the rule was setup
Is this to be expected? If so is there somewhere to read the explination?
02-02-2016 10:29 AM
I just received notifaction from support indicating although the action is set to deny in the policy the actual action can be different.
01-05-2016 03:26 AM
Do you have a security profile attached to the rule?
I'm wondering if that traffic may be hitting a threat id that has an action for reset both.
01-05-2016 06:11 AM
@lewishttps://downloads.paloaltonetworks.com/software/PAN-OS-7.0.4-RN.pdf?__gda__=1452055432_eb7de8c610922...
Under Changes to Default Behavior
"The default actions for handling threats now are alert or reset-both (sides of the connection). In releases prior to PAN-OS 7.0.0, the defaults were alert or block. On upgrade, the block action will be converted to reset-both; and the drop-packets option is now renamed as drop."
I looked at out "Application Deny Rule" which has no security profiles just the "deny" action selected and we've got "Reset-Both" as the action. So I guess it's just not a "threat" but for any "Deny." With the "drop" action now available. I'm guessing that selecting "Deny" is going to be the same as selecting "reset-both."
01-05-2016 09:40 AM
this was a part of my initial thinking too as we do have security profiles associated to the rules. However under further invesigation the traffic in question is not associated to any threat signatures.
01-05-2016 09:42 AM
Thanks Brandon_Wertz. I will have a look at this
01-25-2016 09:57 AM
I have since logged a ticket with support and they are still investigating as a possible bug as the action should only match what the policy is set too.
02-02-2016 10:29 AM
I just received notifaction from support indicating although the action is set to deny in the policy the actual action can be different.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!