Question Regarding Reporting

[tfitzgerald]

Hi All!

I'm responsible for Security Analysis at a Telecommunications company up in New England. We've recently deployed Palo Alto firewalls to all sites, and I am currently going through PDF Reports manually while we get Splunk installed.

One thing that confuses me is that occasionally, when doing a custom report, we get a traffic action I'm not familiar with. Typically we see 'alert' or 'drop all packets'. However, in one of our sites, we're seeing traffic labeled as 'reset-both' (image below, fifth line. This report is custom, created from the threat logs at this site).

Can someone explain what this action means in comparison to 'drop all packets'? Thanks!

-Travis Fitzgerald

[gswcowboy · Accepted solution]

Reset-both: When selected as the action on the signature, the firewall will drop the packet and send a TCP reset to both client and server.  This action is available in vulnerability protection exceptions.

  Drop-all-Packets: When selected as the action on the signature, the firewall will drop every subsequent packet for that connection.  This action is available in vulnerability protection exceptions.

[tfitzgerald]

Awesome, thanks. That's just what I needed.