Packet Buffer Protection (PBP)

User_707 — Thu, 15 May 2025 18:19:26 GMT

We are receiving multiple alerts for Packet Buffer Protection (PBP) being triggered on internal-to-internal and internal-to-external traffic. My understanding is that PBP is primarily intended to protect against DoS attacks, which are typically external-to-internal in nature.
Is it expected behavior for PBP to be triggered by internal-to-internal or internal-to-external traffic? Should PBP be configured to monitor all traffic directions, or is it best practice to apply it mainly for external-to-internal flows? Any insight or recommendations would be appreciated.

Re: Packet Buffer Protection (PBP)

mshekh — Fri, 16 May 2025 09:37:33 GMT

Hi @User_707 ,

Thanks for info, It's completely depends on environment and requirements. You can configure it for internal-internal or internal-to-external traffic.

You can refer the below docs for more details:

DoS and Zone Protection Best Practices

https://docs.paloaltonetworks.com/best-practices/dos-and-zone-protection-best-practices/dos-and-zone-protection-best-practices/deploy-dos-and-zone-protection-using-best-practices

Baseline CPS Measurements for Setting Flood Thresholds

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/zone-protection-and-dos-protection/zone-defense/take-baseline-cps-measurements-for-setting-flood-thresholds

Zone protection profiles

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clm9CAC

How to Measure CPS

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/zone-protection-and-dos-protection/zone-defense/take-baseline-cps-measurements-for-setting-flood-thresholds/how-to-measure-cps

How to Verify if Zone Protection is Working

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClhzCAC

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/zone-protection-and-dos-protection/zone-defense/packet-buffer-protection

topic Packet Buffer Protection (PBP) in Advanced Threat Prevention Discussions

Packet Buffer Protection (PBP)

Re: Packet Buffer Protection (PBP)