topic Re: Securing inbound traffic in General Topics

Securing inbound traffic

svanrooyen — Fri, 23 May 2014 22:40:02 GMT

Hi all,

Hopefully a fairly straight forward beginner question. If I'm wanting to securely set up a basic inbound rule to direct traffic to a web service in our DMZ (from a single external source address), is it best to specify the source address in the NAT or Security policy - or both? I'm trying to figure out the pro's and con's for both scenarios.

Thanks,

Steve

Re: Securing inbound traffic

HULK — Fri, 23 May 2014 23:03:29 GMT

Hello Steve,

As per the packet flow in PAN firewall, It will evaluate the NAT policy first and then, according to the translated address ( NAT'd), it will search for an appropriate security policy.

I would suggest you to specify the source address in your NAT configuration, just to secure your webserver. Even if, you will not specify the source address on your NAT policy, the traffic will still be validated by security-policy lookup. So, you must specify the source address into your security policy. Otherwise, anyone can initiate a traffic to the public IP (server's public IP address hosted in PAN firewall) and utilize it's CPU cycles.

Hope this helps.

Thanks

Re: Securing inbound traffic

svanrooyen — Sat, 24 May 2014 00:35:46 GMT

Sounds sensible - thanks Hulk.