I don't know how to set zone protection

[SilverTiger]

Hi~

I have a question,,

We know that,,,

Paloalto appliance is not primary dos soultion

so one support some dos feature (TCP Flood, UDP Flood, ICMP 0 Packet someting like that etc,,)

I had poc from customer site

I set zone protection between Tap Zone and Tap zone

customer asked me;;

why is palaalto do not represent about source ip and dst ip,,,

also I don't know too until now,,,

That mean is that Monitor  - Threat

There are many Threat Traffic

but,, only TCP Flood was not Attacker and Vicitim IP Address

just represent 0.0.0.0

0.0.0.0

how come,,,~

Tell me the reaseon?

Customer is very curious;;

and so

If I set Policy Dos Protection

should monitoring threat is represent 0.0.0.0?

That it

bye

[panos]

Check this document and it'll show you how it works

https://live.paloaltonetworks.com/servlet/JiveServlet/downloadBody/5078-102-5-14892/Understanding_Do...

[SilverTiger]

where can I find 0.0.0.0?

[emr_1 · Accepted solution]

page15

In addition, I'll let you know how to use Adobe PDF Reader.

Adobe Reader X * Save, view, and search PDFs

If you are using other PDF Reader, please google it by yourself.

People was discussing about same topic in the following thread.

I recommend you to read this thread too.

[SilverTiger]

Thank you~!

First, I will check how to attack way,, T-T

It is hard to study

and If I configured Dos Profile(Policy - Dos Protection) Can I see ip address

because,,, Soure Zone, Address | Dst Zone, Address could be configured by Dos Protection