topic Re: Tweaking DSRI in General Topics

Tweaking DSRI

BobW — Thu, 15 Nov 2012 02:52:13 GMT

So I keep hearing that disabling DSRI will improve performance. I thought I read that most vendors do not even offer the option.

What are some guidelines for disabling DSRI? I understand that incoming to own internal server is probably ok, but what about disabling for some client security rules. Immediate examples are trusted sites like Netflix, X-box access, wii access, etc.

Thanks

Bob

Re: Tweaking DSRI

mikand — Thu, 15 Nov 2012 08:35:04 GMT

I had to Google to find out what DSRI stands for:

DSRI = Disable Server Response Inspection (in case someone else wonders 😉

I found this document at the same time regarding performance figures:

http://www.commsolutions.com/uploads/PA-lNetwork%20World%20PA-5060%20Review.pdf

So yes if performance is an issue (and you cant get more PA-boxes to cluster as described in http://www.paloaltonetworks.com/literature/solution-briefs/tech-partners/arista.pdf ) you can enable DSRI (that is disabling server response inspection) for specific flows.

However there are many cases where disabling DSRI (that is enable server response inspection) would be good security wise.

Clients browsing the Internet is probably the most obvious (this way we can detect infected clients (trying to infect servers) but also infected servers trying to infect clients). This including "trusted" sites.

But I think it can be healthy also for incoming traffic to your own internal servers. If you have DSRI enabled for those flows you wont detect (and possible block) if one of these servers gets infected. And the risk might be higher for that on internal networks because you often keep a track on patching (hopefully 😉 the servers in DMZ (facing Internet) but internal servers tends to get sloppy after a while (or are appliances where it depends on how active the vendor is before patches are released). Probably because the threat isnt as visible as with that Internet facing DMZ.

I wonder if the PA-devices are "smart enough" to not perform server response inspection where this inspection wouldnt find something bad anyway (which on its own might be bad aswell if you enable IPS and it actually wont do as you think it does)?

Or for that matter what is disabled when you disable server response inspection? Could you for example enable inspection for the antivirus engine but disable it for the IPS - and if so, would you really gain something performancewise as quoting from the above pdf:

Regardless of which UTM features we enabled - intrusion prevention, antispyware, antivirus, or any combination of these - results were essentially the same as if we'd turned on just one such feature. Simply put, there's no extra performance cost, beyond the initial sharp drop in rates, for layering on multiple types of traffic inspection.

Edit: Changed some text above because disabling DSRI actually enables server response inspection :smileysilly: