Hide Public IPs

[mark1ped]

I've been getting a lot of traffic from 'unfriendly' countries trying to gain access to a service we provide via one of our NAT'ed public ip address. I know for a fact they have no business connecting to that service. Is there a setting on the Palo Alto to hide my Public ip addresses? In that same vain, can I also hide what ports/protocols I have open to the outside world?

Thank you

[mikand]

You can set a security rule before your current allow rule which will blacklist certain ranges.

In PA you can set range by country (this list is basically maxmind's GeoIP and some other sources if im not mistaken and updated through app-id database I think) so you can somewhat "ban" a whole country or region. And in case you dont want to see these blocks in your logs this blacklist rule can be set to not log a thing.

A better method is to make your allow rule as narrow as possible.

The design could be:

1) Blacklist rules (as wide as possible and mostly to ban for global access no matter which service they wish to connect to).

2) Allow rules (as narrow as possible).

3) Default deny + log (stuff that isnt allowed elsewhere should be logged if you are interrested in those logs).

The tricky part is that the "attacker" will of course, depending on protocol, see that they are being blocked because PA currently doesnt allow you to set HOW the blacklist should block the client (which method is being used depends on which protocol the client requested and is set by PA themselfs).

It seems that many PA-users have already sent this as a feature request to their Sales Engineers (so it would be great if you could do this aswell) so you as a PA-admin could decide how the block should be performed (just drop or deny where the deny will send a packet back to the client with either tcp-rst or icmp net/host unreachable or icmp administratively prohibited).

In your case I would prefer to just drop the traffic (the attacker will not get an answer at all not even that the port is closed).