topic Re: To drop or deny in General Topics

To drop or deny

jdprovine — Thu, 22 Mar 2018 13:24:07 GMT

I found some best practices documentation on the fuel group site and they recommend drop over deny. So I would be interested to see how people are configuring their fire wall more drops or denies and why?

Re: To drop or deny

reaper — Thu, 22 Mar 2018 14:21:50 GMT

A drop is silent, you simply discard the packet and don't tell anyone about it. This is great for most siatuations as you don't generate more traffic on your network and outsiders who may potentially be scanning you are non the wiser

A deny sends a notification to the sender that something happened and their packet was rejected

This could be helpful in providing a 'friendly' user experience as some applications will be able to pop up an error message telling the user their connection was rejected (instead of timing out, causing the user to have to wait and possibly keep trying), and tell applications to stop trying to connect.

My inbound rules are all drop while my outbound ones are deny (for rules that only trigger on App-ID, eg. "block ftp", you can also pick from 'reset-client', 'reset-server' and 'reset-both' depending which ones are 'internal' and deserve a notification)

I wrote a couple things regarding this, fyi:

https://live.paloaltonetworks.com/t5/Tutorials/Configurable-Deny-Action/ta-p/76613

https://live.paloaltonetworks.com/t5/Featured-Articles/DotW-reset-server-reset-client-or-silent-drop/ta-p/77343

Re: To drop or deny

jdprovine — Thu, 22 Mar 2018 14:41:29 GMT

@reaper

Don't fear the reaper !! So I guess it good for load on your firewall and stretches the days of logs out but could reduce information

Re: To drop or deny

Mick_Ball — Thu, 22 Mar 2018 14:42:28 GMT

yes there are many pages on this stuff...

we opted for similar to @reaper.

untrust to trust... drop

trust to untrust, mostly drop but with a few overlapping policy denies for specific hosts and users

for trust to untrust diagnostics, deny (block all policy session start... not logging to paranormal) is a must, as and when required..

i prefer this to messing around with the default zone policies...

Re: To drop or deny

jdprovine — Thu, 22 Mar 2018 15:00:48 GMT

@Mick_Ball

Are you referring to the zone protection policies when you say default zone policies?

Re: To drop or deny

Mick_Ball — Thu, 22 Mar 2018 15:08:10 GMT

@jdprovine..

No sorry...

the intrazone-default and interzone-default security policies .

you can overide these and enable logging but i prefer to use my own policy to "block all" from my test PC IP address.

if i see any traffic using this policy, then i know one of the many above it is not working properly.

if you get my drift...

Re: To drop or deny

jdprovine — Thu, 22 Mar 2018 18:01:10 GMT

Great info as always @reaper