Traffic log Action shows 'allow' but session end shows 'threat'

[rmcrae]

I looked at several answers posted previously but am still unsure what is actually the end result. 

I'm looking at the monitor\traffic and I can see traffic leaving the local network going to the internet that shows the action is 'allow' and but the session end reason is 'threat'.  Did the traffic actually get forwarded or because the session end reason says 'threat' it may have started the packet forward but stopped it because of the threat? Ideally I'd like to have it drop that traffic rather than allow.

My hardware is a PA220 running 10.1.4.

[PavelK · Accepted solution]

Thank you for the post @rmcrae

What I assume that happened to the traffic you described, the traffic matched policy where based on 6 tuple the policy action was to allow traffic, however during further L7 inspection, threat signature triggered the session end.

If you want to see details of this session, please navigate to magnifying glass on very left, then from detailed log view get session id. From cli, you can check session details:

show session id <session id>

Kind Regards

Pavel

[rmcrae]

That makes sense.  Thank you. So the traffic was able to initiate the session but deeper packet inspection identified a threat and then cut it off.

[PavelK]

Thank you for response @rmcrae 

Yes, this is correct. This behavior is described in this KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HCQlCAO

Kind Regards

Pavel