Difference between session start vs end when doing DENY

[mikand]

The difference (generally speaking) between "log on session start" and "log on session end" (for ALLOW rules) is that the "session end" will also log application and trafficvolume however it will not show up in the log-files until the session really is ended (which means for debugging you often want on session start aswell to see when the packet from the client hits your PAN device).

Until now I have been thinking that "log on session start" is the natural option for DENY rules (if you want the denies to show up in your traffic log). Specially for the case of a last "deny any any log" security rule because there is no application identified at this point and no trafficvolume to speak about (just the syn-packet itself if we take TCP as example).

However, how does the PA device define "log on session end" when it comes to DENY rules?

Is the session ended when the DENY rule is triggered, or is it ended only after a successful finack/ack/finack/ack (since DENY means both "DROP" and "REJECT" in PAN lingo depending on which application/flow is about to be denied)?

I mean is using "on session start" pointless with DENY rules since it will log at the same time as "on session end" with the difference that I will miss application and trafficvolume (if any)?

The goal in my case is to see denied traffic as soon as possible in the log-files (specially when it comes to the "deny any any log" rule).

[sjamaluddin]

In the case of Deny rules, the traffic is denied immediately when it matches the criterion defined in the security policy so the start and end of the session should be the same. As such you'd be fine just logging at the start for a Deny policy. You'd not have to wait for the FIN/ FIN ACK to determine the end of the session

Hope this helps