Zone protection reconnossainse protection

ENAGAS — Mon, 25 Mar 2013 15:24:42 GMT

Hi,

I am testing "reconnossainse protection" feature on a PA-200. I built a reconnossainse protection profile over zone protection tab and I mark over "reconnossainse protection" and I checked "tcp port scan", "host sweep" and "udp port scan" (with default settings). I activated zone protection profile on each zone.

I am executing "nmap" over a subnet (default zenmap settings) but PA don't detect it as a "port scan". I found PA identify that traffic like "ssl webbrowsing rule".

Best regards,

Re: Zone protection reconnossainse protection

Retired Member — Mon, 25 Mar 2013 19:35:42 GMT

You didn't mention what your alert and activate thresholds are set to. One thing you can do is to try lowering these values to lowest possible to ensure that the rule is having the desired affect. If they are then you can increase the values to a more real-world number. But as you mentioned that you are testing, this should help to isolate if things are working as expected.

Also to help verify you can look at global counters to ensure the zone protection is working. This is done via CLI with following command.

> show counter global filter delta yes | match dos

Hope this helps.

-Richard

topic Re: Zone protection reconnossainse protection in General Topics

Zone protection reconnossainse protection

Re: Zone protection reconnossainse protection