topic Policy to allow specific Windows share in Next-Generation Firewall Discussions

Policy to allow specific Windows share

dsmall-pa — Wed, 28 Feb 2024 21:44:33 GMT

I'm trying to find out if it's possible with a Palo firewall to allow access from a DMZ machine to a windows share on an internal file server, however, I would like to allow access to a specific share. The file server on the internal network has several internal use shares. I need a place for a DMZ hosted app to dump files on an internal server but I want to make sure that the system in the DMZ cannot access other shares on the server. I'm hoping I can avoid spinning up a dedicated server.

Re: Policy to allow specific Windows share

kiwi — Tue, 05 Mar 2024 15:25:03 GMT

Hi @dsmall-pa ,

I haven't tested this myself but this should be possible in my opinion using custom vulnerability signatures.

There is a context called "ms-ds-smb-req-share-name" that you probably want to match on.

Hope this helps,

-Kim.