topic BlackNurse Testing Causes issues on Egress Firewall in General Topics

BlackNurse Testing Causes issues on Egress Firewall

bspilde — Tue, 06 Dec 2016 18:32:41 GMT

FYI It doesn't appear to require an attack to be an IP address bound to the PA.

It also appears that testing a remote firewall while egressing through a PA firewall causes your local firewall to experience DOS effects. It is not just inbound to an IP address of a PA's interface or NAT to that interface.

I did an hping3 of type 3 to a remote PA-3020 to test my flood protection in a Zone Protection configuration. In doing so, many of our cloud services became unresponsive through our HQ PA-5060 firewall the testing client was behind.

Re: BlackNurse Testing Causes issues on Egress Firewall

BPry — Tue, 06 Dec 2016 19:25:43 GMT

It sounds like you hit the CPS limits of your device, which in affect would be almost the same as a DOS.

Re: BlackNurse Testing Causes issues on Egress Firewall

bspilde — Tue, 06 Dec 2016 21:01:44 GMT

Sitting at 900 peak out of 120,000 on a regular basis so I don't think that was it. I'll test again specifically watching CPS in show session info as well as CPU utilization. As I recall, our Egress PA did not have any noticible fluctuations in CPU utilization during the hping3 test.

Re: BlackNurse Testing Causes issues on Egress Firewall

BPry — Wed, 07 Dec 2016 14:04:27 GMT

Interesting; keep us posted. Unless I'm completely remembering things wrong the PA wasn't supposed to be affected by this unless you hit the CPS limit due to someone trying to launch the attach.