- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
08-26-2022 07:08 AM
hello everyone,
Firewall is showing session end reason as 'Threat' in traffic logs for the traffic blocked under url filtering profile. this is showing repeatedly, i'm afraid is consuming the Data Plane CPU. IT could be the action of blocking or just the report. But i would like to know if there is a way to block this traffic way before is stop. the source sometimes is the same IP, but then changes to another.
thanks,
08-26-2022 10:55 AM
Hello,
Unfortunately the answer is it depends due to not enough information. I would say look at the traffic and see if its valid, meaning not malicious. Then determine if its normal traffic and not something a use is doing. Depending on the amount of traffic will depend on the CPU usage.
Regards,
08-26-2022 03:11 PM
How much traffic are you actually seeing identified, and is it actually causing a load on your firewall? If you're just seeing the occasional entry that has you concerned, that's just the firewall working appropriately. It's not abundantly clear that you have an actual problem from what you've described.
While I personally would look into external remediation methods that pull data from the firewall (or SIEM or other product), you can look into Auto-Tag and dropping the IP through a dedicated security rule base entry directly on the firewall in question. I would highly recommend building out that process elsewhere, but this works in small environments. Just keep in mind that just because a threat is identified doesn't automatically mean that you should be blocking the IP in question from your environment.
08-29-2022 06:27 AM
Hi, it cost the data plane CPU go up to 92% and many people started to complain about the availability of the applications, I helped a little bit by blocking non US IPs, but still happen from US IPs, not as much as before. sometimes the dp CPU goes up to 80 but it goes back down once these threat traffic stop sending their request. I cannot block the IPs since it changes every now and them... I will update the software since I'm using 10.1.5-h1 to see it that fix it, as I read this software can have some DoS vulnerabilities.
08-29-2022 07:54 AM
Hello,
Please check your inbound policies and make sure you dont have any URL Filtering on them. There is a bug on this and someone can DoS your PAN if you have this configured.
Regards,
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!