I have been seeing some Heart-bleed PAN alerts. I want to set the default action from 'alert' to 'drop'. But I am not sure if this would block some legitimate packets.

Since there are a vast number of teams, it is impossible to completely upgrade all servers.

My environment consists of hundreds of clients and servers.

Has anyone blocked heartbleed messages through their PAN (or any other firewall)? Any side effects?

1 Answer 1


Very much depends on the signature that is used to match the Heartbleed attack. Unfortunately, most do generate false positives. I have customers with Fortigates, where they have used the rule with a 5-minute quarantine action. Results were pretty bad, they practically DoS-ed hundreds of legitimate customers. But there's a difference between quarantine and a simple "drop" policy. Your case should be a milder one.

I'd like to suggest that you monitor that alert for a period of time, e.g. 1 week and investigate the alerts, and follow up with the alerts to examine whether these are coming from a legitimate source, or are malicious scans/attempts to exploit the bug.

Also suggest carrying out a pilot/trial with a smaller team over a limited period of time.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .