topic Protocol Protection Layer 2 or Vwire in Advanced Threat Prevention Discussions

Protocol Protection Layer 2 or Vwire

AndyYerger — Thu, 07 Dec 2017 17:47:33 GMT

My question would it be important to add protocol protection in Zone Protection if you are running layer 2 or vwire on you palo alto fiewalll? and if so should it be placed on untrust or trust or both?

Re: Protocol Protection Layer 2 or Vwire

OtakarKlier — Mon, 18 Dec 2017 23:56:07 GMT

Hello,

So the short answer is it depends on your environment and policies. Here are my thoughts:

Protect as much as possible without compromising security or performance. I have a VWire that is protecting another device and I do have threat protection on it. This way the PAN can block/stop the traffic so the vwire device doesnt get hit with it. For me everything inbound gets this treatment, i.e. the border. Outbound traffic is a different story, some I do and some I dont. It protects not only me if a host is potentially compromised but also others so my potentially compromised host doesnt attack someone else.

I hope that makes sense.

Regards,

Re: Protocol Protection Layer 2 or Vwire

AndyYerger — Tue, 19 Dec 2017 23:43:31 GMT

Thanks for the reply food for thought.