session end reason as 'Threat'

[YParreno]

hello everyone,

Firewall is showing session end reason as 'Threat' in traffic logs for the traffic blocked under url filtering profile.   this is showing repeatedly, i'm afraid is consuming the Data Plane CPU.  IT could be the action of blocking or just the report.  But i would like to know if there is a way to block this traffic way before is stop.   the source sometimes is the same IP, but then changes to another. 

thanks,

[OtakarKlier]

Hello,

Unfortunately the answer is it depends due to not enough information. I would say look at the traffic and see if its valid, meaning not malicious. Then determine if its normal traffic and not something a use is doing. Depending on the amount of traffic will depend on the CPU usage.

Regards,

[BPry]

@YParreno,

How much traffic are you actually seeing identified, and is it actually causing a load on your firewall? If you're just seeing the occasional entry that has you concerned, that's just the firewall working appropriately. It's not abundantly clear that you have an actual problem from what you've described. 

While I personally would look into external remediation methods that pull data from the firewall (or SIEM or other product), you can look into Auto-Tag and dropping the IP through a dedicated security rule base entry directly on the firewall in question. I would highly recommend building out that process elsewhere, but this works in small environments. Just keep in mind that just because a threat is identified doesn't automatically mean that you should be blocking the IP in question from your environment.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/register-ip-addresses-and-tags-dyna...

[YParreno]

Hi, it cost the data plane  CPU go up to 92% and many people started to complain about the availability of the applications,  I helped a little bit by blocking non US IPs, but still happen from US IPs, not as much as before.   sometimes the dp CPU goes up to 80 but it goes back down once these threat traffic stop sending their request.   I cannot block the IPs since it changes every now and them... I will update the software since I'm using 10.1.5-h1 to see it that fix it, as I read this software can have some DoS vulnerabilities.  

[OtakarKlier]

Hello,

Please check your inbound policies and make sure you dont have any URL Filtering on them. There is a bug on this and someone can DoS your PAN if you have this configured.

Regards,