Effectivenes of DOS protection

[mario.chancay]

Hi, will appreciate the comments of the PAN community about the efectivenes of the DOS protection features of Palo Alto. 

Are there DOS attacks that can't be mitigated by Palo Alto ?

Thks

Mario

[pkruse]

Mario,

Lets address the meaning of DOS for our viewers.

In a denial-of-service (DoS) attack, an attacker attempts to prevent legitimate users from accessing information or services. By targeting your computer, servers, routers and its network connection, or the computers and network of the sites you are trying to use, an attacker may be able to prevent you from accessing email, websites, online accounts (banking, etc.), or other services that rely on the affected computer.

The most common and obvious type of DoS attack occurs when an attacker "floods" a network with information. When you type a URL for a particular website into your browser, you are sending a request to that site's computer server to view the page. The server can only process a certain number of requests at once, so if an attacker overloads the server with requests, it can't process your request. This is a "denial of service" because you can't access that site.

The most widely used method is known as a syn-flood attack. The purpose of a Syn-flood is to exhaust the session tables of the targeted device with fake sessions and thus prevent new sessions from being created. There are many other DOS styles but they are mainly identified by this type of behavior.

The Paloalto firewalls are well equipped for these types of attacks and our Zone protection can be employed to mitigate or prevent the impact of several types of attacks. As an example of the Syn-flood the PANOS can be configured to intercept the inbound SYN packet and validate its authenticity, if it fails our check it is discarded and now session entry is made.

Our Firewalls employ several methods to safeguard networks from malicious attacks. Please refer to our product literature for information of each systems capabilities.

~Phil