IP Drop - Spoofing - Internal Zones Only?

[kmcfarland-tt]

     I am trying to understand why the PAN-OS documentation seems to suggest that when configuring and applying Zone Protection Profiles, for IP Spoofing protection (IP Drop-Spoofed IP address), that it should be enabled for 'Internal Zones Only' (see references below). This appears to be counter to every discussion, video tutorial (both PA sponsored and other), and best practices/benchmarks I have read/seen where IP Spoof protections are recommended to be enabled for all zones, including untrusted/Internet facing zones.

     Am I mis-reading/understanding the documentation or is it really the case the 'Discard-IP-Spoof' is NOT recommended for a Zone Protection profile meant to be applied to an untrust/Internet facing zone?

Thanks.

Reference:

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/network/network-network-profi...

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface-help/network/network-network-profi...

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/network/network-network-profi...

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-web-interface-help/network/network-network-prof...

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-web-interface-help/network/network-network-prof...

[LAYER_8]

How would this work for external zones? Here is what the feature accomplishes:

Check that the source IP address of the ingress packet is routable and the routing interface is in the same zone as the ingress interface. If either condition is not true, discard the packet.

So, an internal zone (receiver of ingress packets) checks that wherever the packet says it is going, is both reachable from the table on hand, and that table matches the zone the packet is coming into. Else, drop.

On an external zone, you don't control the routing table, so how would that check be accomplished?