Traffic log Action shows 'allow' but session end shows 'threat'

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Traffic log Action shows 'allow' but session end shows 'threat'

L3 Networker

I looked at several answers posted previously but am still unsure what is actually the end result. 

I'm looking at the monitor\traffic and I can see traffic leaving the local network going to the internet that shows the action is 'allow' and but the session end reason is 'threat'.  Did the traffic actually get forwarded or because the session end reason says 'threat' it may have started the packet forward but stopped it because of the threat? Ideally I'd like to have it drop that traffic rather than allow.

My hardware is a PA220 running 10.1.4.

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Thank you for the post @rmcrae

 

What I assume that happened to the traffic you described, the traffic matched policy where based on 6 tuple the policy action was to allow traffic, however during further L7 inspection, threat signature triggered the session end.

 

If you want to see details of this session, please navigate to magnifying glass on very left, then from detailed log view get session id. From cli, you can check session details:

 

show session id <session id>

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

View solution in original post

5 REPLIES 5

Cyber Elite
Cyber Elite

Thank you for the post @rmcrae

 

What I assume that happened to the traffic you described, the traffic matched policy where based on 6 tuple the policy action was to allow traffic, however during further L7 inspection, threat signature triggered the session end.

 

If you want to see details of this session, please navigate to magnifying glass on very left, then from detailed log view get session id. From cli, you can check session details:

 

show session id <session id>

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

That makes sense.  Thank you. So the traffic was able to initiate the session but deeper packet inspection identified a threat and then cut it off.

Cyber Elite
Cyber Elite

Thank you for response @rmcrae 

 

Yes, this is correct. This behavior is described in this KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HCQlCAO

 

Kind Regards

Pavel

Help the community: Like helpful comments and mark solutions.

Hello, there's a way to stop the traffic being classified and ending the session because of threat? Sometimes it does not categorized this as threat but others do. 

@denisse_puebla 

That depends on why the traffic was classified as a threat. You need to look at the specific block details to know which rules caused the threat detection. from there you can determine why it was blocked and where you may need to apply an exception.

 

For instance, if you allow HTTPS to the internet and the traffic was blocked as a threat, in the log details you may see:

Session End Reason: threat

Type: url

Action: block-url

Category: web-advertisement

 

This traffic was identified as a web ad and blocked per your URL filtering policy, Objects->Security Profiles->URL Filtering->[profile name] is set to "block". You can change the entire category from "block" to "allow" (not ideal) or create a custom URL filter (Objects->Custom Objects->URL Category->[category name]) and allow just that category in your URL filter.

 

You may also see something like this:

Session End Reason: threat

Type: vulnerability

Threat Name: Microsoft MSXML Memory Vulnerability

ID: 35646

Content Version: AppThreat-8602-7491

 

This traffic was blocked as the content was identified as matching an Application&Threat database entry. You can view the threat database  details by clicking the threat ID. Under Objects->Security Profiles->Vulnerability Protection-[protection name] you can view default action for that specific threat ID. From the Exceptions tab, click the "Show all signatures" checkbox at the bottom and then filter by ID number. If you are sure it is a false positive you can add specific exceptions by IP address, or change the default threat action. To add an IP exception click "Enable" on the specific threat ID. Then click under "IP Address Exemption" and enter IPs in the popup box to exclude an IP from filtering that particular threat. To completely change the default action, click "Enable" and then change the "Action" to Allow or your preferred action.

  • 1 accepted solution
  • 6852 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!