Adding Threat Exceptions

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Adding Threat Exceptions

Not applicable

Hi,  I wonder if somebody can help me with a query?

I am running a 2050 as my firewall (I am new to looking after Palo Altos!).   I have colleagues building workstations at another site coming across a VPN to access resources at my site.  The router and links are working fine.

One particular application is not getting through and is being blocked as a threat.  The entry in the log is:
SIP CSeq Header Field Integer Overflow

ID:  31788

Severity: HIGH

Description:

Several SIP based products are prone to an integer overflow while handling crafted requests containing invalid sequence numbers in CSeq header field. An attacker could exploit the vulnerability by sending a crafted request containing margin integer values in CSeq header. A successful exploit could lead to remote code execution or crash the server.

I have the option Add to Threat Exception which I would like to press to see if it fixes my problem.  Before I press the button I would like to know where this exception is stored and how can I remove it if I want to reinclude it?

Going forward can I create a policy which only allows it through if it is coming from s specific IP subnet?

Any questions then let me know.

Regards,

Phil

4 REPLIES 4

L5 Sessionator

Hi Phil,

Sounds PANOS 5.0 would be nice for you.

The detail of threat log looks as below on 5.0.4.

You can select profile and also you can use Exempt IP address (this is new from 5.0)

WS000014.JPG

Regards,

Emr

Not applicable

Hi EMr,

Thanks for your quick reply.   We did install 5.0.4 but it appeared to cause problems with our internet connectivity (This is still being looked at by PA) so we reverted back to 4.x

Do you know where the exception is stored if I press the Add Threat Exception button and whether it is possible to undo it?

Phil

You can choose profile even you run 4.1

The following doc might help you.

How to Tune IPS in PAN-OS 4.1

This also might help you.

Regards,

Emr

L4 Transporter

You need to create a separate Vulnerability protection profile for the policy rules that you want to make exceptions for, as the exceptions are applied to the Vulnerability protection Profile. If you want it to be excepted from all rules, just except it from your generic Vulnerability protection profile.

The inherent vice of capitalism is the unequal sharing of blessings; the inherent virtue of socialism is the equal sharing of miseries.
  • 4098 Views
  • 4 replies
  • 0 Likes
  • 101 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!