Vulnerability Protection Profile

[DCleve]

Hello!

I have a rule with a vulnerability protection profile enabled between my VPN users and DMZ.

I need to WebGUI (8443/8080) into a new DMZ server, but VP is stopping it.

How do I make an exception for this traffic?

Thanks,

DC

[PavelK]

Hello @DCleve

thanks for posting.

I would recommend to review traffic and security logs from: Monitor > Logs > Traffic / Threat to confirm exact reason for traffic to be denied / dropped. If you confirmed that vulnerability signature is causing an issue, here are 2 KBs for applying an exception either on signature or IP address level:

How to create a vulnerability exception

Vulnerability Exception Based Upon Source and Destination IP Address to change the default behavior  

If you believe this is a false positive, you can reported: How to Submit a Vulnerability Signature False Positive 

Kind Regards

Pavel

[DCleve]

Thanks for the reply, PK.

This is strange. The Traffic logs report that the traffic is allowed, but I'm getting nothing but RST, ACK (with no connection), allegedly from the server.

The server, though, shows that it's listening on ports 8080 and 8443. I'm second-guessing my theory that the problem is Vulnerability protection. As I research, APP-ID could also be the problem, but again, all traffic is "allowed" in the traffic logs and isn't present in the Threat logs.

Any help here would be appreciated.

I assumed the problem was vulnerability protection because a profile is attached to the policy, but I see nothing in the traffic or threat logs indicating this.

[PavelK]

Hello @DCleve

thank you for reply.

To eliminate assumptions, could you check Unified logs with server's IP address in filter from: Monitor > Logs > Unified? Unified logs have all log types in one screen.

If it is possible could you take a packet capture from server? Also if it is possible could you temporarily take vulnerability profile out of the policy and test connection?

Kind Regards

Pavel