unable to identify attcak and threat on firewall ip

[NickySorot]

Q. our auditor scanned our firewall IP from outside network but we unable to identify and check the attack and threat on firewall ip but able to check on servers public IP in threat option. can any1 suggest where we can check in paloalto?

[kiwi]

Hi,

To protect yourself from scans you can configure Zone Protection.

The zone protection logs are stored under threat logs.

This  might be useful (p.46 - Zone Protection):

Threat Prevention Deployment

I hope it helps.

-Kim.

[VinceM]

Hi,

Depend of you PANOS version but by default the IntrZone traffic (Untrust to Untrust) is not loggued. Mean no trace in logs.

You need to activate them.

After that if you want to be protected against floods, fragmented packet ... you need to configure both zone protection and / or DOS policy.

Hope help.

V.

[Raido_Rattameister]

And security profiles must be configured.

Otherwise Palo does not scan for threats.