Allow and then drop

[jdprovine]

I have traffic that is showing up and allowed and dropped. What does that mean?

[reaper]

Hi

Could you show us an example through a screenshot ?

It may be that you have logging set to start and end of session and that a connection is first being allowed but later denied due to the application morphing into a blocked app

[jdprovine]

Yes here it is 

[reaper · Accepted solution]

if you look at the bottom 2 lines, you can see that in the column 'log' you have a threat entry and a traffic entry

this means that the initial dns connection was allowed to go out to the internet, but then a malicious dns query was detected by a security profile (spyware) and blocked.

there are 2 different databases that collect log information regarding a session:

• traffic log: this simply records if a tcp connection is allowed through or not by security policy
• threat log: this records, independently of the traffic log, if a threat is detected and which action is taken, if any

so it's possible a sssion is allowed through by a security policy, but then after it has aleready started gets blocked because a threat is detected

hope this helps

Tom

[jdprovine]

So as long as the users has spyware on his machine he will continue to back on the door of the PA and then get denied. According to the predefined report the user is number 5 of the top sessions on the PA should I be concerned about that?

[reaper]

If this is a user and you're seeing a lot of threat logs matching his or her IP address, it would certainly warrant you taking a look and running a couple of virus scans on the machine

[jdprovine]

I agree but my helpdesk did not LOL.