Traffic log Action shows 'allow' but session end shows 'threat'

[rmcrae]

I looked at several answers posted previously but am still unsure what is actually the end result. 

I'm looking at the monitor\traffic and I can see traffic leaving the local network going to the internet that shows the action is 'allow' and but the session end reason is 'threat'.  Did the traffic actually get forwarded or because the session end reason says 'threat' it may have started the packet forward but stopped it because of the threat? Ideally I'd like to have it drop that traffic rather than allow.

My hardware is a PA220 running 10.1.4.

[PavelK · Accepted solution]

Thank you for the post @rmcrae

What I assume that happened to the traffic you described, the traffic matched policy where based on 6 tuple the policy action was to allow traffic, however during further L7 inspection, threat signature triggered the session end.

If you want to see details of this session, please navigate to magnifying glass on very left, then from detailed log view get session id. From cli, you can check session details:

show session id <session id>

Kind Regards

Pavel

[rmcrae]

That makes sense.  Thank you. So the traffic was able to initiate the session but deeper packet inspection identified a threat and then cut it off.

[PavelK]

Thank you for response @rmcrae 

Yes, this is correct. This behavior is described in this KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HCQlCAO

Kind Regards

Pavel

[denisse_puebla]

Hello, there's a way to stop the traffic being classified and ending the session because of threat? Sometimes it does not categorized this as threat but others do. 

[Adrian_Jensen]

@denisse_puebla 

That depends on why the traffic was classified as a threat. You need to look at the specific block details to know which rules caused the threat detection. from there you can determine why it was blocked and where you may need to apply an exception.

For instance, if you allow HTTPS to the internet and the traffic was blocked as a threat, in the log details you may see:

Session End Reason: threat

Type: url

Action: block-url

Category: web-advertisement

This traffic was identified as a web ad and blocked per your URL filtering policy, Objects->Security Profiles->URL Filtering->[profile name] is set to "block". You can change the entire category from "block" to "allow" (not ideal) or create a custom URL filter (Objects->Custom Objects->URL Category->[category name]) and allow just that category in your URL filter.

You may also see something like this:

Session End Reason: threat

Type: vulnerability

Threat Name: Microsoft MSXML Memory Vulnerability

ID: 35646

Content Version: AppThreat-8602-7491

This traffic was blocked as the content was identified as matching an Application&Threat database entry. You can view the threat database  details by clicking the threat ID. Under Objects->Security Profiles->Vulnerability Protection-[protection name] you can view default action for that specific threat ID. From the Exceptions tab, click the "Show all signatures" checkbox at the bottom and then filter by ID number. If you are sure it is a false positive you can add specific exceptions by IP address, or change the default threat action. To add an IP exception click "Enable" on the specific threat ID. Then click under "IP Address Exemption" and enter IPs in the popup box to exclude an IP from filtering that particular threat. To completely change the default action, click "Enable" and then change the "Action" to Allow or your preferred action.