Different Actions for Security Rules

[Nikko]

Hi Guys,

I would like to know what are the difference between the following actions in the security rules for PA.

1. Deny

2. Drop

3. Reset-client

4. Reset-server

5. Reset-both

Which of these are the most preferred to use? Is deny or drop action also resets the connection for both server and client? 

Thanks

[kiwi]

Hi @Nikko ,

Here are all actions explained:

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/security-policy/security-policy-ac...

Cheers !

-Kiwi.

[jdelio]

@Nikko You asked:

"Which of these are the most preferred to use? Is deny or drop action also resets the connection for both server and client? "

Answer:

It really depends on what you are wanting to do. If this is normal traffic, then a Deny would be fine. 

If this is traffic that you would want the remote end to not "get a response" , then you would use Drop.

as far as the reset.. the note states:

A reset is sent only after a session is formed. If the session is blocked before a 3-way handshake is completed, the firewall will not send the reset.

I hope this helps.

[Kamron]

If no Deny Action is listed, the packets will be silently discarded. Drop-reset will discard the session's packets and send a TCP RST packet to let the client know the session has been terminated so it can gracefully close the session locally. In case the session is UDP or ICMP based, an ICMP Unreachable will be sent

[Justin468]

---

@iMessage PC wrote:

Hi Guys,

I would like to know what are the difference between the following actions in the security rules for PA.

1. Deny

2. Drop

3. Reset-client

4. Reset-server

5. Reset-both

Which of these are the most preferred to use? Is deny or drop action also resets the connection for both server and client? 

Thanks

---

Relies upon what you are needing to do. On the off chance that this is typical traffic, at that point a Deny would be fine. On the off chance that this is traffic that you would need the far off finish to not "get a reaction" , at that point you would utilize Drop.