topic Re: Avoid Attack from outise in PA in General Topics

Avoid Attack from outise in PA

BigPalo — Mon, 24 Jun 2019 09:57:05 GMT

HI,

We are having attacks from outside to DMZ. Many diffrents ips are attacking our public range. These attacks are causing packet buffer 100% and CPU 100%, doing an outage in our network. So in traffic logs we can see all sesiones being denied for policy deny. Is there any way to avoid that FW proccess these sessions and not increasing CPU?? what actions can be taken in FW?

thanks

Re: Avoid Attack from outise in PA

JulioMancia — Mon, 24 Jun 2019 13:48:53 GMT

Zone Protection profile and DoS Protection. Any details on the type of traffic?

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/zone-protection-and-dos-protection/zone-defense.html

Re: Avoid Attack from outise in PA

BigPalo — Mon, 24 Jun 2019 14:18:30 GMT

Yes, i enabled but i think with the default paramethers is not helping a lot.

I attach a screenshot where you can see the sessions. Many sessions from differents ipsin the same second.The most of sessions are using the ports 744 and 736.

Any idea for not proccessing these sessions? to avoid impact in CPU

Re: Avoid Attack from outise in PA

lestrada — Mon, 24 Jun 2019 15:18:01 GMT

I cannot think of anything else to do but to shut down the interface until the attack is over. Let me know if you find an answer as it is an interesting topic. Sorry I cannot help more. If attack is not intended directly to you then it should not last too long. Good luck.

Re: Avoid Attack from outise in PA

workarounds — Mon, 24 Jun 2019 15:31:58 GMT

Which appliance do you have? What is the normal dp load on the firewall while it is not under attack?

You may want to not logging those policy-deny, because it is consuming CPU..

Re: Avoid Attack from outise in PA

lestrada — Mon, 24 Jun 2019 15:57:37 GMT

PA 3050- normal DP is around 8-10%

sessions count 84564/543435

Re: Avoid Attack from outise in PA

OtakarKlier — Mon, 24 Jun 2019 16:43:47 GMT

Hello,

You have to tune the Zone Protection and DoS protection limits to your environment. I started by using the default values then halving then and waiting until I found a number that was comfortable.

Sorry there is not a more specific answer. But dropping the traffic at the Zone Protection profile will utilize the least amount of CPU. Also if its from the same IP's over and over you can just put in a block policy at the top and let it drop the traffic that way or contact your ISP and have them block them for you?

Also enable the External Dynamic Lists and have them drop the traffic. If its detected as a vulnerability, anti-spyware, or even Zone Protection, you can block the IP for up to an Hour automatically.

Might be worth a look.

Re: Avoid Attack from outise in PA

BPry — Mon, 24 Jun 2019 18:37:39 GMT

@BigPalo,

As @OtakarKlier already mentioned, Zone Protection and DoS Policies aren't something that can simply be enabled with default values and function correctly.

Do you have anything in front of the Firewall that can actually drop traffic, such as a router? If so, you could either start null routing traffic you identify with the firewall logs until you reach substainable levels or create a signature to drop the traffic directly on the router so your firewall can continue to function properly. Outside of that there isn't a quick fix that will really work.

Re: Avoid Attack from outise in PA

S.Cantwell — Mon, 24 Jun 2019 20:40:42 GMT

Perhaps a suggestion to slow/limit may be to take a look at a document I created

https://live.paloaltonetworks.com/t5/General-Topics/Using-the-Log-Forwarding-Built-In-Actions-to-create-Dynamic/td-p/267612

It uses a Dynamic Address Group, along with a (somewhat simple auto-tagging from the Log Forwarding Profile) to tag "Bad Ppl", so that when this Address Group hits my DoS Policy, they are immediately dropped.

Not a lot of fine tuning required.

Thanks

Steve