topic Create a rule in General Topics

Create a rule

s_quasar — Thu, 19 Oct 2017 07:56:25 GMT

Hi,

is there a way to create a rule like this?

( session_end_reason eq aged-out ) and ( zone.dst eq SERVER ) and ( app eq incomplete ) and ( rule eq MY OUTSIDE RULE ) and ( bytes eq 308 )

block the IP for 300 seconds

Re: Create a rule

reaper — Thu, 19 Oct 2017 12:35:18 GMT

not like that, but you can enable zone protection with syn cookies and tweak reconnaissence / packet based attacks to prevent odd connections like this from ever reaching the policy

Re: Create a rule

s_quasar — Thu, 19 Oct 2017 14:14:09 GMT

Hi,
Yes I agree with you but I have some problems with DoS Protection.
Can you read my post here https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Discussions/Tcp-flood/td-p/182561 and help me?

Thank you.

Re: Create a rule

reaper — Thu, 19 Oct 2017 14:26:07 GMT

i'll reply to that article