topic Re: Inconsistent documentation on zone protection in General Topics

Inconsistent documentation on zone protection

rvandegrift — Tue, 04 Nov 2014 16:16:19 GMT

Hello,

Palo Alto's documentation is inconsistent on the behavior of flood protection when it is applied by a zone protection policy.

1) "Threat Prevention Deployment Tech Note - Version 2.0 RevA", page 44 says that the zone protection based flood protection applies per source-destination-port tuple:

"Configure Flood Protection settings based on the number of packets you want to allow to each service behind the firewall. Settings apply to all traffic that enters the network through any interface in the zone on which the Zone Protection Profile is active, but a separate counter is maintained for each source IP/destination IP/destination port tuple."

2) "Threat Prevention Deployment Tech Note - Version 2.0 RevA", page 45 directly contradicts this:

"Flood Protection enabled under Zone Protection is applied to the aggregate traffic seen on a specific zone. It will maintain a single counter for all traffic, regardless of source IP/destination IP/destination port."

Which is correct?

Thanks,

Ross

Re: Inconsistent documentation on zone protection

ssharma — Tue, 04 Nov 2014 16:32:04 GMT

Hi rvandegrift

With regards to Zone protection, statement number 2 is accurate. That is, it is applied to specific zones regardless of number of interfaces associated with it. And for this purpose, there is only single counter.

Separate counter mentioned in statement 1 is for Reconnaissance Protection, which will maintain counter for all different attempts made to sniff the traffic. Hope this helps. Thank you.

Re: Inconsistent documentation on zone protection

rvandegrift — Tue, 04 Nov 2014 16:34:36 GMT

What makes you think that the first comment applies to reconnaissance protection? The quote above is from the flood protection section.

Re: Inconsistent documentation on zone protection

ssharma — Tue, 04 Nov 2014 16:40:45 GMT

Yes, the comment is from Flood Protection, but the statement "separate counter is maintained for each source IP/destination IP/destination port tuple", makes sense with reconnaissance protection as attacker will try to sniffs various ports on same destination or different ports on different destinations. Where as in flood, attacker will flood the network mostly to a known or single ip rendering it useless to process other legitimate request.