Actions in Security Profiles
Table of Contents
Expand all | Collapse all
-
- Objects > Addresses
- Objects > Address Groups
- Objects > Regions
- Objects > Dynamic User Groups
- Objects > Application Groups
- Objects > Application Filters
- Objects > Services
- Objects > Service Groups
- Objects > Devices
- Objects > External Dynamic Lists
- Objects > Custom Objects > Spyware/Vulnerability
- Objects > Custom Objects > URL Category
- Objects > Security Profiles > Antivirus
- Objects > Security Profiles > Anti-Spyware Profile
- Objects > Security Profiles > Vulnerability Protection
- Objects > Security Profiles > File Blocking
- Objects > Security Profiles > WildFire Analysis
- Objects > Security Profiles > Data Filtering
- Objects > Security Profiles > DoS Protection
- Objects > Security Profiles > Mobile Network Protection
- Objects > Security Profiles > SCTP Protection
- Objects > Security Profile Groups
- Objects > Log Forwarding
- Objects > Authentication
- Objects > Decryption > Forwarding Profile
- Objects > Schedules
-
-
- Firewall Interfaces Overview
- Common Building Blocks for Firewall Interfaces
- Common Building Blocks for PA-7000 Series Firewall Interfaces
- Tap Interface
- HA Interface
- Virtual Wire Interface
- Virtual Wire Subinterface
- PA-7000 Series Layer 2 Interface
- PA-7000 Series Layer 2 Subinterface
- PA-7000 Series Layer 3 Interface
- Layer 3 Interface
- Layer 3 Subinterface
- Log Card Interface
- Log Card Subinterface
- Decrypt Mirror Interface
- Aggregate Ethernet (AE) Interface Group
- Aggregate Ethernet (AE) Interface
- Network > Interfaces > VLAN
- Network > Interfaces > Loopback
- Network > Interfaces > Tunnel
- Network > Interfaces > SD-WAN
- Network > VLANs
- Network > Virtual Wires
-
- Network > Network Profiles > GlobalProtect IPSec Crypto
- Network > Network Profiles > IPSec Crypto
- Network > Network Profiles > IKE Crypto
- Network > Network Profiles > Monitor
- Network > Network Profiles > Interface Mgmt
- Network > Network Profiles > QoS
- Network > Network Profiles > LLDP Profile
- Network > Network Profiles > SD-WAN Interface Profile
-
-
- Device > Setup
- Device > Setup > Management
- Device > Setup > Interfaces
- Device > Setup > Telemetry
- Device > Setup > Content-ID
- Device > Setup > WildFire
- Device > Setup > DLP
- Device > Log Forwarding Card
- Device > Config Audit
- Device > Administrators
- Device > Admin Roles
- Device > Access Domain
- Device > Authentication Sequence
- Device > Device Quarantine
-
- Security Policy Match
- QoS Policy Match
- Authentication Policy Match
- Decryption/SSL Policy Match
- NAT Policy Match
- Policy Based Forwarding Policy Match
- DoS Policy Match
- Routing
- Test Wildfire
- Threat Vault
- Ping
- Trace Route
- Log Collector Connectivity
- External Dynamic List
- Update Server
- Test Cloud Logging Service Status
- Test Cloud GP Service Status
- Device > Virtual Systems
- Device > Shared Gateways
- Device > Certificate Management
- Device > Certificate Management > Certificate Profile
- Device > Certificate Management > OCSP Responder
- Device > Certificate Management > SSL/TLS Service Profile
- Device > Certificate Management > SCEP
- Device > Certificate Management > SSL Decryption Exclusion
- Device > Certificate Management > SSH Service Profile
- Device > Response Pages
- Device > Server Profiles
- Device > Server Profiles > SNMP Trap
- Device > Server Profiles > Syslog
- Device > Server Profiles > Email
- Device > Server Profiles > HTTP
- Device > Server Profiles > NetFlow
- Device > Server Profiles > RADIUS
- Device > Server Profiles > TACACS+
- Device > Server Profiles > LDAP
- Device > Server Profiles > Kerberos
- Device > Server Profiles > SAML Identity Provider
- Device > Server Profiles > DNS
- Device > Server Profiles > Multi Factor Authentication
- Device > Local User Database > Users
- Device > Local User Database > User Groups
- Device > Scheduled Log Export
- Device > Software
- Device > Dynamic Updates
- Device > Licenses
- Device > Support
- Device > Policy Recommendation
-
- Network > GlobalProtect > MDM
- Network > GlobalProtect > Clientless Apps
- Network > GlobalProtect > Clientless App Groups
- Objects > GlobalProtect > HIP Profiles
-
- Use the Panorama Web Interface
- Context Switch
- Panorama Commit Operations
- Defining Policies on Panorama
- Log Storage Partitions for a Panorama Virtual Appliance in Legacy Mode
- Panorama > Setup > Interfaces
- Panorama > High Availability
- Panorama > Administrators
- Panorama > Admin Roles
- Panorama > Access Domains
- Panorama > Device Groups
- Panorama > Plugins
- Panorama > Log Ingestion Profile
- Panorama > Log Settings
- Panorama > Server Profiles > SCP
- Panorama > Scheduled Config Export
End-of-Life (EoL)
Actions in Security Profiles
The action specifies how the firewall responds to a
threat event. Every threat or virus signature that is defined by Palo
Alto Networks includes a default action, which is typically either
set to Alert, which informs you using the option
you have enabled for notification, or to Reset Both,
which resets both sides of the connection. However, you can define
or override the action on the firewall. The following actions are
applicable when defining Antivirus profiles, Anti-Spyware profiles,
Vulnerability Protection profiles, custom spyware objects, custom
vulnerability objects, or DoS Protection profiles.
Action | Description | Antivirus Profile | Anti-Spyware profile | Vulnerability Protection Profile | Custom Object—Spyware and Vulnerability | DoS Protection Profile |
---|---|---|---|---|---|---|
Default | Takes the default action that is specified
internally for each threat signature. For antivirus profiles,
it takes the default action for the virus signature. | — | Random Early Drop | |||
Allow | Permits the application traffic. The Allow action does
not generate logs related to the signatures or profiles. | — | ||||
Alert | Generates an alert for each application
traffic flow. The alert is saved in the threat log. | Generates
an alert when attack volume (cps) reaches the Alarm threshold set
in the profile. | ||||
Drop | Drops the application traffic. | — | ||||
Reset Client | For TCP, resets the client-side connection. For
UDP, the connection is dropped | — | ||||
Reset Server | For TCP, resets the server-side connection. For
UDP, the connection is dropped | — | ||||
Reset Both | For TCP, resets the connection on both client
and server ends. For UDP, the connection is dropped | — | ||||
Block IP | Blocks traffic from either a source or a source-destination pair;
Configurable for a specified period of time. | — | ||||
Sinkhole | This action directs DNS queries for malicious domains
to a sinkhole IP address. The action is available for Palo Alto
Networks DNS- signatures and for custom domains included in Objects
> External Dynamic Lists. | — | — | — | — | — |
Random Early Drop | Causes the firewall to randomly drop packets
when connections per second reach the Activate Rate threshold in
a DoS Protection profile applied to a DoS Protection rule. | — | — | — | — | |
SYN Cookies | Causes the firewall to generate SYN cookies
to authenticate a SYN from a client when connections per second
reach the Activate Rate Threshold in a DoS Protection profile applied
to a DoS Protection rule. | — | — | — | — |
You cannot delete a profile that is used in a policy rule;
you must first remove the profile from the policy rule.