topic Re: Zone protection profile in Next-Generation Firewall Discussions

Zone protection profile

vishalrsshah — Wed, 04 Dec 2024 18:15:26 GMT

Hi All,

I'm planning to implement Zone protection on outside interfaces using Strict IP Address Check" or only "Spoofed IP address" in the packet based attack protection of the zone protection profile. Does it drop legitimate traffic as per below points

1) Configure static one to one Snat and vice versa for reverse natting

2) Does it impact if any one of my Server's (in Dmz) are in same public ip address range as my Outside interface

Re: Zone protection profile

CosminM — Wed, 04 Dec 2024 18:31:21 GMT

Hello,

Please look bellow to see what checks are performed by the firewall when you activate "Spoofed IP address" and "Strict IP Address Check" in Zone Protection:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004LnmCAE

Re: Zone protection profile

vishalrsshah — Wed, 04 Dec 2024 18:53:14 GMT

Hi,

That I already gone through. Need to know what will be the impact as per my query

Re: Zone protection profile

TomYoung — Wed, 04 Dec 2024 19:01:51 GMT

Hi @vishalrsshah ,

You want to know if configuring the NGFW to drop spoofed packets will impact production traffic. Not is you enable "Spoofed IP address" only. As the URL posted by @CosminM states, dropping spoofed packets relies on the routing table. If your routing is working fine, then IP spoof drops will work fine. The 2 examples that you mention route fine now.

If you enable "Strict IP Address Check" then you may have production drops if you have asymmetric routing.

I enable "Spoofed IP address" on all my NGFWs, and it works fine. I apply my Zone Protection Profile to all my interfaces.

One thing that many people do not know is that these spoofed IP drops along with other packet-based drops are not logged by default. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wkr7CAA

Here is a good article on troubleshooting spoofed IP drops. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UuJCAU

Thanks,

Tom

Re: Zone protection profile

vishalrsshah — Thu, 05 Dec 2024 09:11:15 GMT

Thank you for reply.

So it means my reverse natting and server with public ip address in any zone would not be impact by packet based protection

Re: Zone protection profile

TomYoung — Thu, 05 Dec 2024 11:38:04 GMT

Hi @vishalrsshah ,

I cannot comment on specific configuration that I do not know in detail.

If the routing is working correctly now, then "Spoofed IP address" packet protection will not break it.

Thanks,

Tom