Allow and then drop

Reply
Highlighted
L4 Transporter

Allow and then drop

I have traffic that is showing up and allowed and dropped. What does that mean?

 

 


Accepted Solutions
Highlighted
L7 Applicator

if you look at the bottom 2 lines, you can see that in the column 'log' you have a threat entry and a traffic entry

this means that the initial dns connection was allowed to go out to the internet, but then a malicious dns query was detected by a security profile (spyware) and blocked.

 

there are 2 different databases that collect log information regarding a session:

  • traffic log: this simply records if a tcp connection is allowed through or not by security policy
  • threat log: this records, independently of the traffic log, if a threat is detected and which action is taken, if any

 

so it's possible a sssion is allowed through by a security policy, but then after it has aleready started gets blocked because a threat is detected

 

 

hope this helps

Tom

Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374

View solution in original post


All Replies
Highlighted
L7 Applicator

Hi

 

Could you show us an example through a screenshot ?

It may be that you have logging set to start and end of session and that a connection is first being allowed but later denied due to the application morphing into a blocked app

Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374
Highlighted
L4 Transporter

Yes here it is allowblock.png

Highlighted
L7 Applicator

if you look at the bottom 2 lines, you can see that in the column 'log' you have a threat entry and a traffic entry

this means that the initial dns connection was allowed to go out to the internet, but then a malicious dns query was detected by a security profile (spyware) and blocked.

 

there are 2 different databases that collect log information regarding a session:

  • traffic log: this simply records if a tcp connection is allowed through or not by security policy
  • threat log: this records, independently of the traffic log, if a threat is detected and which action is taken, if any

 

so it's possible a sssion is allowed through by a security policy, but then after it has aleready started gets blocked because a threat is detected

 

 

hope this helps

Tom

Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374

View solution in original post

Highlighted
L4 Transporter

So as long as the users has spyware on his machine he will continue to back on the door of the PA and then get denied. According to the predefined report the user is number 5 of the top sessions on the PA should I be concerned about that?

Highlighted
L7 Applicator

If this is a user and you're seeing a lot of threat logs matching his or her IP address, it would certainly warrant you taking a look and running a couple of virus scans on the machine

 

Tom Piens - PANgurus.com
Like my answer? check out my book! amazon.com/dp/1789956374
Highlighted
L4 Transporter

I agree but my helpdesk did not LOL. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!