topic Re: Zone Protection in General Topics

Zone Protection

it.unit — Tue, 26 Jan 2016 08:07:13 GMT

I have a question related to zone protection. I am having a company doing vulnerability scanning on my system and I want to be able to disable zone protection only for the IP's of the scanner. What would be the best way to acomplish this? Any help much apreciated. At the moment there is one zone protection profile that is applied to my "External" zone.

Regards

Jakob

Re: Zone Protection

kiwi — Tue, 26 Jan 2016 08:52:21 GMT

Hi,

As far as I know, only if you have an option to add this IP to a different zone, it's possible to bypass the scanning. Otherwise, there is no straightforward way to achieve this.

I do know there is a feature request (FR) for this already. Please reach out to your local SE and ask him to vote for the FR.

Regards,

-Kim.

Re: Zone Protection

Raido_Rattameister — Tue, 26 Jan 2016 15:35:03 GMT

zone protection policies are "zone based" so you don't have capability to exclude some specific ip address.

Re: Zone Protection

OtakarKlier — Tue, 26 Jan 2016 15:39:17 GMT

Hello,

We do our own periodic scanning and I also ran into this. The work around I used was on the scanner. I set it with the lowest/slowest possible settings so it would not trigger the zone protection. Not the greatest since an actor can use this to scan us, but it was the only way.

Regards,

Re: Zone Protection

it.unit — Thu, 28 Jan 2016 15:02:35 GMT

Hi Kim

Many thanks for this, I asked my SE to vote for the feature.

Kind Regards

Jakob

Re: Zone Protection

it.unit — Thu, 28 Jan 2016 15:03:59 GMT

Hi Otakar

Thanks for this, yes I guess this could also be used as a "workaround" untill PaloAlto gives us a more permanent solution

Regards

Jakob

Re: Zone Protection

Raido_Rattameister — Fri, 29 Jan 2016 09:10:17 GMT

I'm pretty sure that zone protection will never work based on source/destination.

As those packets are thrown away before being processed in that level.

If you want this functionality then you should use DoS policy where you can exactly specify source(s) and destination(s).

What you lack with DoS is misformated packets (fragmented traffic, ping of death etc).

Re: Zone Protection

Gun-Slinger — Mon, 28 Mar 2016 18:18:12 GMT

Can someone produce the FR # for this?

Thanks