Adding Threat Exceptions

[phild]

Hi,  I wonder if somebody can help me with a query?

I am running a 2050 as my firewall (I am new to looking after Palo Altos!).   I have colleagues building workstations at another site coming across a VPN to access resources at my site.  The router and links are working fine.

One particular application is not getting through and is being blocked as a threat.  The entry in the log is:
SIP CSeq Header Field Integer Overflow

ID:  31788

Severity: HIGH

Description:

Several SIP based products are prone to an integer overflow while handling crafted requests containing invalid sequence numbers in CSeq header field. An attacker could exploit the vulnerability by sending a crafted request containing margin integer values in CSeq header. A successful exploit could lead to remote code execution or crash the server.

I have the option Add to Threat Exception which I would like to press to see if it fixes my problem.  Before I press the button I would like to know where this exception is stored and how can I remove it if I want to reinclude it?

Going forward can I create a policy which only allows it through if it is coming from s specific IP subnet?

Any questions then let me know.

Regards,

Phil

[emr_1]

Hi Phil,

Sounds PANOS 5.0 would be nice for you.

The detail of threat log looks as below on 5.0.4.

You can select profile and also you can use Exempt IP address (this is new from 5.0)

Regards,

Emr

[phild]

Hi EMr,

Thanks for your quick reply.   We did install 5.0.4 but it appeared to cause problems with our internet connectivity (This is still being looked at by PA) so we reverted back to 4.x

Do you know where the exception is stored if I press the Add Threat Exception button and whether it is possible to undo it?

Phil

[emr_1]

You can choose profile even you run 4.1

The following doc might help you.

How to Tune IPS in PAN-OS 4.1

This also might help you.

Regards,

Emr

[craymond]

You need to create a separate Vulnerability protection profile for the policy rules that you want to make exceptions for, as the exceptions are applied to the Vulnerability protection Profile. If you want it to be excepted from all rules, just except it from your generic Vulnerability protection profile.