vulnerability block action

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

vulnerability block action

L3 Networker

Hi,

when creating a profile choosing block action is seen as "reset-both" on the logs.

is that normal behaviour or not ? Thanks.

just_one_rule.png

logsrelated.png

1 accepted solution

Accepted Solutions

L7 Applicator

PA should probably update the help file for these vulnerability options.  The wording is ambiguous and I assume that block was a drop and not a reset action.

Action

Choose the action (Alert, Allow, Default, or Block) to take when the rule is triggered. The Default action is based on the pre-defined action that is part of each signature provided by Palo Alto Networks. To view the default action for a signature, navigate to Objects > Security Profiles > Vulnerability Protection and click Add or select an existing profile. Click the Exceptions tab and then click Show all signatures. A list of all signatures will displayed and you will see an Action column.

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center

View solution in original post

10 REPLIES 10

L7 Applicator

Hello Panlst,

This is an expected behavior. In this case, the PAN firewall blocked that Vulnerability and send TCP RST packet to both parties ( Server and client) to close the connection.

Thanks

L7 Applicator

PA should probably update the help file for these vulnerability options.  The wording is ambiguous and I assume that block was a drop and not a reset action.

Action

Choose the action (Alert, Allow, Default, or Block) to take when the rule is triggered. The Default action is based on the pre-defined action that is part of each signature provided by Palo Alto Networks. To view the default action for a signature, navigate to Objects > Security Profiles > Vulnerability Protection and click Add or select an existing profile. Click the Exceptions tab and then click Show all signatures. A list of all signatures will displayed and you will see an Action column.

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center

L7 Applicator

Hello Panlst,


As per the screenshots attached in this discussion thread, the firewall identifies the vulnerability with threat ID: 35107


Vulnerability-reset-action-1.jpg

If you check the default action of this Vulnerability signature, is to reset the connection.


Hope this helps.


Thanks

But PanLst is choosing "Block" not "Default" for the action.

The help file does not specify which action occurs with "Block" drop or reset.  Are you saying above that the action is reset both? 

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center

but we choose block not default.There is something wrong here.Block = reset both

Hello Panlst,

My apologies, i understand it wrongly. You are correct, As per the DOC: Vulnerability Profile Actions  if traffic is hitting this vulnerability-protection rule, it should simply drop all packets for that session.

Could you please provide a snapshot of the traffic logs and security rule, just to confirm  the vulnerability rule "ALL" applied to the correct policy.

Thanks

Hi HULK;

I replicated that.

Here are the screens.I think there is something wrong with definitions or explanations.

4.png

3.png2.png1.png

The default action is defined by Palo Alto Networks on a per-threat basis as either alert or block.

Every vulnerability has a "block" behavior.  Some block behaviors send a reset to the server or client, or in this case, both.  For this example the default action is block, and the block behavior is reset-both.  Even though the action being taken is block, the threat log will show the block behavior that was used to terminate the session under the action column.

Quick edit:

If you want to change the "block" behavior for a threat, you must configure an exception.

Thanks for answer.

So block behaviour should be added somewhere on the guides as definiton also I think.

It's hard form me make Definition to any of this Threat ID, Like XMRig Miner Command and Control Traffic Detection(85886) or MVPower DVR Shell Unauthenticated Command Execution Vulnerability(57566).
 Do you have any guide or E-Book for make any definition of Threat ID.

  • 1 accepted solution
  • 5919 Views
  • 10 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!