topic Re: unable to identify attcak and threat on firewall ip in General Topics

unable to identify attcak and threat on firewall ip

NickySorot — Wed, 25 Nov 2015 13:15:56 GMT

Q. our auditor scanned our firewall IP from outside network but we unable to identify and check the attack and threat on firewall ip but able to check on servers public IP in threat option. can any1 suggest where we can check in paloalto?

Re: unable to identify attcak and threat on firewall ip

kiwi — Wed, 25 Nov 2015 15:50:43 GMT

Hi,

To protect yourself from scans you can configure Zone Protection.

The zone protection logs are stored under threat logs.

This might be useful (p.46 - Zone Protection):

Threat Prevention Deployment

I hope it helps.

-Kim.

Re: unable to identify attcak and threat on firewall ip

VinceM — Wed, 25 Nov 2015 15:53:24 GMT

Hi,

Depend of you PANOS version but by default the IntrZone traffic (Untrust to Untrust) is not loggued. Mean no trace in logs.

You need to activate them.

After that if you want to be protected against floods, fragmented packet ... you need to configure both zone protection and / or DOS policy.

Hope help.

Re: unable to identify attcak and threat on firewall ip

Raido_Rattameister — Wed, 25 Nov 2015 18:45:49 GMT

And security profiles must be configured.

Otherwise Palo does not scan for threats.