Securing inbound traffic

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Securing inbound traffic

L0 Member

Hi all,

Hopefully a fairly straight forward beginner question.  If I'm wanting to securely set up a basic inbound rule to direct traffic to a web service in our DMZ (from a single external source address), is it best to specify the source address in the NAT or Security policy - or both?  I'm trying to figure out the pro's and con's for both scenarios.

Thanks,

Steve

1 accepted solution

Accepted Solutions

L7 Applicator

Hello Steve,

As per the packet flow in PAN firewall, It will evaluate the NAT policy first and then, according to the translated address ( NAT'd), it will search for an appropriate security policy.

I would suggest you to specify the source address in your NAT configuration, just to secure your webserver. Even if, you will not specify the source address on your NAT policy, the traffic will still be validated by security-policy lookup.  So, you must specify the source address into your security policy. Otherwise, anyone can initiate a traffic to the public IP (server's public IP address hosted in PAN firewall) and utilize it's CPU cycles.

PacketProcessing-PAN.PNG

Hope this helps.

Thanks

View solution in original post

2 REPLIES 2

L7 Applicator

Hello Steve,

As per the packet flow in PAN firewall, It will evaluate the NAT policy first and then, according to the translated address ( NAT'd), it will search for an appropriate security policy.

I would suggest you to specify the source address in your NAT configuration, just to secure your webserver. Even if, you will not specify the source address on your NAT policy, the traffic will still be validated by security-policy lookup.  So, you must specify the source address into your security policy. Otherwise, anyone can initiate a traffic to the public IP (server's public IP address hosted in PAN firewall) and utilize it's CPU cycles.

PacketProcessing-PAN.PNG

Hope this helps.

Thanks

Sounds sensible - thanks Hulk.

  • 1 accepted solution
  • 2155 Views
  • 2 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!