DSRI on IPSec/VPN traffic

[LCMember1643]

We have a rule allowing VPN traffic (IPSec) from our Guest environment. This traffic is non-decryptable. We would like to reduce CPU by disabling Server Response Inspection for this traffic? Do we lose anything from a security perspective if we do so? If there is a change in the application, will app-id still detect it?

[Remo]

As you already wrote this traffic cannot be decrypted. So the only (very) little thing you or better say your guests loose from a security perspective is that your paloalto cannot protect your guests from vulnerabilities that can be exploited from vpn gateways to their clients. --> as it is your guestnetwork, i don't see a reason that you need to protect them from malicious vpn gateways.

The firewall is still able to detect app changes, but only in the client2server traffic and no longer in server2client traffic.

[Raido_Rattameister]

I don't think you get any benefit as if Palo identifies application that is encrypted (like SSL) and you don't apply decyption policy it will let it through the firewall without trying to apply deep packet inspection.

[Remo]

@Raido_Rattameister

You're absolutely right. When the tunnel is already established, palo only sees jibberish where it is not able to check anything.

But there could be rare edge cases, while establishing a tunnel, a malformed response could be very dangerous, if there is a vulnerability in the vpn client software (not the first time something like that happens). A vulnerability like that could be detected by palo.

Very theoretical, but ... 😉

[Raido_Rattameister]

Agree.

I should be really desperate to turn DSRI on (read: firewall really overloaded and no way to get it upgraded).

Even if you host servers they might get compromised and with DSRI you don't identify if they start attacking others or website starts spreading viruses around.