topic Re: DSRI for VPN Tunnel in General Topics

DSRI for VPN Tunnel

VincentPresogna — Tue, 05 Nov 2019 23:06:09 GMT

I can't seem to find a clear answer to this, and there may not be one. I have a VPN tunnel between 2 sites, both on PA-820's. Would "disable server response inspection" on the VPN policy on both sides benefit from this? What are the potential downsides if I did do this?

Re: DSRI for VPN Tunnel

S.Cantwell — Tue, 05 Nov 2019 23:31:23 GMT

Hello there

You should probably NOT perform DSRI between the VPN. (do not checkbox the setting)

Either site could have dirty traffic/malware/etc, so it is best to not disable a security setting like that.

You want the FW to scan for all threat potential traffic.

Re: DSRI for VPN Tunnel

VincentPresogna — Tue, 05 Nov 2019 23:43:44 GMT

Thanks Steve,

That's pretty much what my conclusion was also, just wanted some verification.