session end reason as 'Threat'

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

session end reason as 'Threat'

L1 Bithead

hello everyone,

 

Firewall is showing session end reason as 'Threat' in traffic logs for the traffic blocked under url filtering profile.   this is showing repeatedly, i'm afraid is consuming the Data Plane CPU.  IT could be the action of blocking or just the report.  But i would like to know if there is a way to block this traffic way before is stop.   the source sometimes is the same IP, but then changes to another. 

thanks,

4 REPLIES 4

Cyber Elite
Cyber Elite

Hello,

Unfortunately the answer is it depends due to not enough information. I would say look at the traffic and see if its valid, meaning not malicious. Then determine if its normal traffic and not something a use is doing. Depending on the amount of traffic will depend on the CPU usage.

 

Regards,

Cyber Elite
Cyber Elite

@YParreno,

How much traffic are you actually seeing identified, and is it actually causing a load on your firewall? If you're just seeing the occasional entry that has you concerned, that's just the firewall working appropriately. It's not abundantly clear that you have an actual problem from what you've described. 

 

While I personally would look into external remediation methods that pull data from the firewall (or SIEM or other product), you can look into Auto-Tag and dropping the IP through a dedicated security rule base entry directly on the firewall in question. I would highly recommend building out that process elsewhere, but this works in small environments. Just keep in mind that just because a threat is identified doesn't automatically mean that you should be blocking the IP in question from your environment.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/register-ip-addresses-and-tags-dyna...

Hi, it cost the data plane  CPU go up to 92% and many people started to complain about the availability of the applications,  I helped a little bit by blocking non US IPs, but still happen from US IPs, not as much as before.   sometimes the dp CPU goes up to 80 but it goes back down once these threat traffic stop sending their request.   I cannot block the IPs since it changes every now and them... I will update the software since I'm using 10.1.5-h1 to see it that fix it, as I read this software can have some DoS vulnerabilities.  

Cyber Elite
Cyber Elite

Hello,

Please check your inbound policies and make sure you dont have any URL Filtering on them. There is a bug on this and someone can DoS your PAN if you have this configured.

Regards,

  • 4498 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!