About Aamirjan

Hello,   A customer has a Palo Alto perimeter firewall and a Fortigate DCFW which sits behind the PA in the line of traffic when incoming from the internet .   It has been observed that in a scenario when the Palo Alto firewall which has SSL Inbound inspection enabled for all internet facing applications and the vulnerability protection signatures are said to 'drop' action, the firewall still seems to be forwarding packets to the Fortigate FW whose IPS engine gets triggered  for the same vulnerability and it blocks packets from the same attacker IP address.   I want to understand if this is a bug or the recommended action should be set to a different one for this to be avoided? Ideally the traffic should never each the Fortigate.   The screenshots from the PA and Fortigate  modules are attached. The PAN OS version is 9.1.15-h1.   Thank you!   Aamir Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended. Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended. ... View more