Zone Protection

[it.unit]

HI

I have a question related to zone protection. I am having a company doing vulnerability scanning on my system and I want to be able to disable zone protection only for the IP's of the scanner. What would be the best way to acomplish this? Any help much apreciated. At the moment there is one zone protection profile that is applied to my "External" zone.

Regards

Jakob

[kiwi · Accepted solution]

Hi,

As far as I know, only if you have an option to add this IP to a different zone, it's possible to bypass the scanning. Otherwise, there is no straightforward way to achieve this.

I do know there is a feature request (FR) for this already.  Please reach out to your local SE and ask him to vote for the FR.

Regards,

-Kim.

[Raido_Rattameister]

zone protection policies are "zone based" so you don't have capability to exclude some specific ip address.

[OtakarKlier · Accepted solution]

Hello,

We do our own periodic scanning and I also ran into this. The work around I used was on the scanner. I set it with the lowest/slowest possible settings so it would not trigger the zone protection. Not the greatest since an actor can use this to scan us, but it was the only way.

Regards,

[it.unit]

Hi Kim

Many thanks for this, I asked my SE to vote for the feature.

Kind Regards

Jakob

[it.unit]

Hi Otakar

Thanks for this, yes I guess this could also be used as a "workaround" untill PaloAlto gives us a more permanent solution

Regards

Jakob

[Raido_Rattameister · Accepted solution]

I'm pretty sure that zone protection will never work based on source/destination.

As those packets are thrown away before being processed in that level.

If you want this functionality then you should use DoS policy where you can exactly specify source(s) and destination(s).

What you lack with DoS is misformated packets (fragmented traffic, ping of death etc).

[Gun-Slinger]

Can someone produce the FR # for this?

Thanks