topic Re: DSRI on IPSec/VPN traffic in General Topics

DSRI on IPSec/VPN traffic

LCMember1643 — Tue, 01 Aug 2017 15:37:30 GMT

We have a rule allowing VPN traffic (IPSec) from our Guest environment. This traffic is non-decryptable. We would like to reduce CPU by disabling Server Response Inspection for this traffic? Do we lose anything from a security perspective if we do so? If there is a change in the application, will app-id still detect it?

Re: DSRI on IPSec/VPN traffic

Remo — Tue, 01 Aug 2017 16:38:49 GMT

As you already wrote this traffic cannot be decrypted. So the only (very) little thing you or better say your guests loose from a security perspective is that your paloalto cannot protect your guests from vulnerabilities that can be exploited from vpn gateways to their clients. --> as it is your guestnetwork, i don't see a reason that you need to protect them from malicious vpn gateways.

The firewall is still able to detect app changes, but only in the client2server traffic and no longer in server2client traffic.

Re: DSRI on IPSec/VPN traffic

Raido_Rattameister — Tue, 01 Aug 2017 16:49:13 GMT

I don't think you get any benefit as if Palo identifies application that is encrypted (like SSL) and you don't apply decyption policy it will let it through the firewall without trying to apply deep packet inspection.

Re: DSRI on IPSec/VPN traffic

Remo — Tue, 01 Aug 2017 17:15:06 GMT

@Raido_Rattameister

You're absolutely right. When the tunnel is already established, palo only sees jibberish where it is not able to check anything.

But there could be rare edge cases, while establishing a tunnel, a malformed response could be very dangerous, if there is a vulnerability in the vpn client software (not the first time something like that happens). A vulnerability like that could be detected by palo.

Very theoretical, but ... 😉

Re: DSRI on IPSec/VPN traffic

Raido_Rattameister — Tue, 01 Aug 2017 17:24:45 GMT

Agree.

I should be really desperate to turn DSRI on (read: firewall really overloaded and no way to get it upgraded).

Even if you host servers they might get compromised and with DSRI you don't identify if they start attacking others or website starts spreading viruses around.