Securing inbound traffic

[svanrooyen]

Hi all,

Hopefully a fairly straight forward beginner question.  If I'm wanting to securely set up a basic inbound rule to direct traffic to a web service in our DMZ (from a single external source address), is it best to specify the source address in the NAT or Security policy - or both?  I'm trying to figure out the pro's and con's for both scenarios.

Thanks,

Steve

[HULK · Accepted solution]

Hello Steve,

As per the packet flow in PAN firewall, It will evaluate the NAT policy first and then, according to the translated address ( NAT'd), it will search for an appropriate security policy.

I would suggest you to specify the source address in your NAT configuration, just to secure your webserver. Even if, you will not specify the source address on your NAT policy, the traffic will still be validated by security-policy lookup.  So, you must specify the source address into your security policy. Otherwise, anyone can initiate a traffic to the public IP (server's public IP address hosted in PAN firewall) and utilize it's CPU cycles.

Hope this helps.

Thanks

[svanrooyen]

Sounds sensible - thanks Hulk.