Best practiecs

[jdprovine]

Is anyone using these recommended settings?

set deviceconfig setting tcp urgent-data clear

set deviceconfig setting tcp drop-zero-flag yes

set deviceconfig setting application bypass-exceed-queue no

set deviceconfig setting tcp bypass-exceed-oo-queue no set deviceconfig setting ctd tcp-bypass-exceed-queue no

set deviceconfig setting ctd udp-bypass-exceed-queue no

set deviceconfig setting tcp check-timestamp-option yes

set deviceconfig setting ctd skip-block-http-range no

[OtakarKlier]

Hello,

Here is what I am running and have not had any issues:

set deviceconfig setting tcp urgent-data clear

set deviceconfig setting tcp drop-zero-flag yes

set deviceconfig setting application bypass-exceed-queue no

set deviceconfig setting tcp bypass-exceed-oo-queue no

set deviceconfig setting ctd tcp-bypass-exceed-queue no

set deviceconfig setting ctd udp-bypass-exceed-queue no

set deviceconfig setting tcp check-timestamp-option yes

Cheers!

[googol]

where are these best practices from? can you link me please?

[glastra1]

googol you can find them in the next link

https://www.paloaltonetworks.com/documentation/61/pan-os/pan-os/threat-prevention/best-practices-for...

regards,

gerardo

[jdprovine]

So what are these setting doing for you? Can you tell anything from the gui or is it all in the command line

[jdprovine]

Is there a way to check these settings before changing them?

[jdprovine]

Also is anyone using zone protection to configure some of these setting or Dos protection profile.

[Brandon_Wertz]

As an aside...Back in 2014 I got my SE to provide a document "Monitoring Best Practices."  

This document is 72 pages in total and describes in detail all aspects of the box.  Might be worth reaching out to your SE and get this document, or perhaps a newer one if they've updated it.

The document is Palo confidential but my company has an NDA with Palo, so you may or may not be able to get this document.

[jdprovine]

Did he provide you with one for 2016?

[Brandon_Wertz]

No I've never asked for an updated one.

[jdprovine]

I was reading online and the person made a good comment if these setting are best practices why aren't they set that way by default?

[jdprovine]

So these weren't set to the best practices by default?  Kinda makes you wonder why