Block on APP-ID (Apache Log4j )

[Scott64]

Hello All,

After a bit of help ...I' have never created a block type rule on a Palo and now my boss wants me to create a .block rule for the above.

We have about 300 policies in the our firewall so no idea how to create a block and apply it .

Can anybody give me any pointers ? 

Regards

[Sample_Wu]

You need to do it by applying vulnerability security profile to each policy, or edit the security profiles you already applied to the security rules.

But, the default action of log4j vulnerability signatures are "reset-server" and severity are critical:

You just need to make sure the rule in each security profile is included severity critical and action is default or other suitable type, as below screenshot of the default profile:

just provide me thought for you as a reference.

Regards,

Sample

[Scott64]

Hi - Thanks for that  - I have created what I hope is correct.

 

 Regards

[Kuhic567]

---

@Scott64 wrote:

Hello All,

After a bit of help ...I' have never created a block type rule on a Palo and now my boss wants me to create a .block rule for the above.

We have about 300 policies in the our firewall so no idea how to create a block and apply it .

Can anybody give me any pointers ? 

Regards

---

Upgrade to Log4j 2.3.2 (for Java 6), 2.12.4 (for Java 7), or 2.17.1 (for Java 8 and later).

In prior releases confirm that if the JDBC Appender is being used it is not configured to use any protocol other than Java.

Note that only the log4j-core JAR file is impacted by this vulnerability. Applications using only the log4j-api JAR file without the log4j-core JAR file are not impacted by this vulnerability.

Also note that Apache Log4j is the only Logging Services subproject affected by this vulnerability. Other projects like Log4net and Log4cxx are not impacted by this.