Please help clarify about action of DoS protection policy.

Jitaphon — Tue, 08 Feb 2022 11:18:31 GMT

We understand DoS protection works when we set action Protect.

We need to know the benefits to setting action Allow and Deny.

Because we think that option is the same as normal security policy.

Thank you.

Re: Please help clarify about action of DoS protection policy.

S.Cantwell — Tue, 08 Feb 2022 15:33:30 GMT

Hello there.

DoS policies are evaluated before security policies, if you truly follow the PANW flow logic.

If true, then the DoS policies are extremely beneficial to protect your network.

Example: Some companies want to block the EDLs (the 4 built in external dynamic lists), and they put them into the security policies, to typically DENY access.

Why not use a DoS policy with the DENY function. This way, if any IP from the 4 EDLs attempt to connect to the FW (before a session is created) the action in DoS can be DENY.

Now, there will always be workarounds, perhaps, the company wants to block foreign countries (example, block non-USA sourced traffic), and then some employees go on vacation to Mexico, and need access to GP.

Well, then you could create an ALLOW rule, above your non-foreign country rule, to allow MEX to try and establish a session.

In summary, I have provided both a DENY and an ALLOW explanations.

Re: Please help clarify about action of DoS protection policy.

Jitaphon — Wed, 09 Feb 2022 04:50:30 GMT

Thank you for your detail.

topic Re: Please help clarify about action of DoS protection policy. in General Topics

Please help clarify about action of DoS protection policy.

Re: Please help clarify about action of DoS protection policy.

Re: Please help clarify about action of DoS protection policy.