topic Re: Best practiecs in General Topics

Best practiecs

jdprovine — Thu, 24 Mar 2016 21:04:16 GMT

Is anyone using these recommended settings?

set deviceconfig setting tcp urgent-data clear

set deviceconfig setting tcp drop-zero-flag yes

set deviceconfig setting application bypass-exceed-queue no

set deviceconfig setting tcp bypass-exceed-oo-queue no set deviceconfig setting ctd tcp-bypass-exceed-queue no

set deviceconfig setting ctd udp-bypass-exceed-queue no

set deviceconfig setting tcp check-timestamp-option yes

set deviceconfig setting ctd skip-block-http-range no

Re: Best practiecs

OtakarKlier — Fri, 25 Mar 2016 14:04:40 GMT

Hello,

Here is what I am running and have not had any issues:

set deviceconfig setting tcp urgent-data clear

set deviceconfig setting tcp drop-zero-flag yes

set deviceconfig setting application bypass-exceed-queue no

set deviceconfig setting tcp bypass-exceed-oo-queue no

set deviceconfig setting ctd tcp-bypass-exceed-queue no

set deviceconfig setting ctd udp-bypass-exceed-queue no

set deviceconfig setting tcp check-timestamp-option yes

Cheers!

Re: Best practiecs

googol — Fri, 25 Mar 2016 16:25:12 GMT

where are these best practices from? can you link me please?

Re: Best practiecs

glastra1 — Fri, 25 Mar 2016 22:52:25 GMT

googol you can find them in the next link

https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/threat-prevention/best-practices-for-securing-your-network-from-layer-4-and-layer-7-evasions#16594

regards,

gerardo

Re: Best practiecs

jdprovine — Mon, 28 Mar 2016 12:55:52 GMT

So what are these setting doing for you? Can you tell anything from the gui or is it all in the command line

Re: Best practiecs

jdprovine — Mon, 28 Mar 2016 13:21:12 GMT

Is there a way to check these settings before changing them?

Re: Best practiecs

jdprovine — Mon, 28 Mar 2016 13:31:59 GMT

Also is anyone using zone protection to configure some of these setting or Dos protection profile.

Re: Best practiecs

Brandon_Wertz — Mon, 28 Mar 2016 17:31:58 GMT

As an aside...Back in 2014 I got my SE to provide a document "Monitoring Best Practices."

This document is 72 pages in total and describes in detail all aspects of the box. Might be worth reaching out to your SE and get this document, or perhaps a newer one if they've updated it.

The document is Palo confidential but my company has an NDA with Palo, so you may or may not be able to get this document.

Re: Best practiecs

jdprovine — Mon, 28 Mar 2016 18:01:13 GMT

Did he provide you with one for 2016?

Re: Best practiecs

Brandon_Wertz — Mon, 28 Mar 2016 18:36:32 GMT

No I've never asked for an updated one.

Re: Best practiecs

jdprovine — Thu, 07 Apr 2016 18:24:28 GMT

I was reading online and the person made a good comment if these setting are best practices why aren't they set that way by default?

Re: Best practiecs

jdprovine — Thu, 07 Apr 2016 19:47:22 GMT

So these weren't set to the best practices by default? Kinda makes you wonder why