How to Configure a Policy with DoS Protection to Protect Hosted Services

Overview

The Palo Alto Networks firewall is configured to host a service. For this example, the firewall is configured to perform destination NAT towards a web server in the Trust network. A policy is now needed for protection against DoS attacks.

Steps

1. 1. Create a custom DoS Protection Profile
      1. Navigate to Objects > DoS Protection
      2. Click Add

      3. Configure the DoS Protection Profile (see example below)

         

         

          

   2. Create a DoS Protection Policy using the profile created in step 1.

      1. Navigate to Policies > DoS Protection

      2. Click Add to bring up a new DoS Rule dialog

      3. Associate the Dos Protection profile created earlier

      4. Set the action to Protect. Default action is Deny, which will deny all traffic matching this flow.

         

         

          

          

Note: The example from above reflects lab environment values for the thresholds. When deploying the setup in production, the values need to be in accordance to the traffic that is expected to be handled by the network.

owner: sberti