Effectivenes of DOS protection

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Reply
Highlighted
L1 Bithead

Effectivenes of DOS protection

Hi, will appreciate the comments of the PAN community about the efectivenes of the DOS protection features of Palo Alto. 

Are there DOS attacks that can't be mitigated by Palo Alto ?

Thks

Mario

Tags (2)
L4 Transporter

Mario,

Lets address the meaning of DOS for our viewers.

In a denial-of-service (DoS) attack, an attacker attempts to prevent legitimate users from accessing information or services. By targeting your computer, servers, routers and its network connection, or the computers and network of the sites you are trying to use, an attacker may be able to prevent you from accessing email, websites, online accounts (banking, etc.), or other services that rely on the affected computer.

The most common and obvious type of DoS attack occurs when an attacker "floods" a network with information. When you type a URL for a particular website into your browser, you are sending a request to that site's computer server to view the page. The server can only process a certain number of requests at once, so if an attacker overloads the server with requests, it can't process your request. This is a "denial of service" because you can't access that site.

The most widely used method is known as a syn-flood attack. The purpose of a Syn-flood is to exhaust the session tables of the targeted device with fake sessions and thus prevent new sessions from being created. There are many other DOS styles but they are mainly identified by this type of behavior.

The Paloalto firewalls are well equipped for these types of attacks and our Zone protection can be employed to mitigate or prevent the impact of several types of attacks. As an example of the Syn-flood the PANOS can be configured to intercept the inbound SYN packet and validate its authenticity, if it fails our check it is discarded and now session entry is made.

Our Firewalls employ several methods to safeguard networks from malicious attacks. Please refer to our product literature for information of each systems capabilities.

~Phil

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!