This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About PPradhan
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About PPradhan
08-10-2022
6Posts
0Likes
0Solutions
Aug 10, 2022Last Visited
User
Activity
User
Profile
Latest posts by PPradhan
| Subject | Views | Posted |
|---|---|---|
| 787 | 07-28-2022 10:16 PM | |
| 961 | 07-26-2022 10:01 PM | |
| 1125 | 07-25-2022 11:52 PM | |
| 1141 | 07-25-2022 10:20 PM | |
| 1280 | 07-15-2022 10:39 PM | |
| 6804 | 07-15-2022 10:28 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like |
User Badges
Community Statistics
| Member Since | 07-15-2022 10:25 PM |
| Date Last Visited | 08-10-2022 10:06 PM |
| Posts | 6 |
07-29-2022
06:35 PM
Hello @PPradhan
would it be possible to share the logs where you see this happening?
Kind Regards
Pavel
... View more
07-27-2022
03:30 AM
Hello @PPradhan
this KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HCQlCAO gives best answer. In nutshell, the log is showing as allowed as it is not blocked by security policy itself (6 tuple), however traffic if processed further by L7 inspection where it is getting block based on threat signature, therefore this session is in the end blocked with end reason threat.
Kind Regards
Pavel
... View more
07-26-2022
12:28 AM
1 Kudo
Thank you for reply @PPradhan
this is correct. Alert means traffic is allowed, only log is generated. Here is a reference to the documentation: https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/policy/security-profiles#id6272be37-1ce2-4374-a431-bfb1db9da9e0_id6a5c6acd-528f-448b-ba83-8a6e1b114a05
Kind Regards
Pavel
... View more
07-18-2022
02:27 PM
@PPradhan,
An aged-out response really just means the firewall never saw a tcp-fin and the session aged-out without a graceful termination. As long as you have a rulebase entry allowing the traffic, the traffic will be allowed through the firewall.
... View more
07-15-2022
11:36 PM
Hello colleague @PPradhan , I leave you here a couple of links that will help you a lot to clarify your doubts greetings
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PMjLCAW
https://live.paloaltonetworks.com/t5/blogs/dotw-aged-out-session-end-in-allowed-traffic-logs/ba-p/379608
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClVFCA0
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClibCAC
https://live.paloaltonetworks.com/t5/blogs/dotw-tcp-resets-from-client-and-server-aka-tcp-rst-from-client/ba-p/378526
https://opensecure.nl/blog/paloalto-application-field/
Greetings
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks