Zone protection profile

[vishalrsshah]

Hi All,

I'm planning to implement Zone protection on outside interfaces using Strict IP Address Check" or only "Spoofed IP address" in the packet based attack protection of the zone protection profile. Does it drop legitimate traffic as per below points

1) Configure static one to one Snat and vice versa for reverse natting

2)  Does it impact if any one of my Server's (in Dmz) are in same public ip address range as my Outside interface

[CosminM]

Hello,

Please look bellow to see what checks are performed by the firewall when you activate "Spoofed IP address" and "Strict IP Address Check" in Zone Protection:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000004LnmCAE 

[vishalrsshah]

Hi,

That I already gone through. Need to know what will be the impact as per my query 

[TomYoung]

Hi @vishalrsshah ,

You want to know if configuring the NGFW to drop spoofed packets will impact production traffic.  Not is you enable "Spoofed IP address" only.  As the URL posted by @CosminM states, dropping spoofed packets relies on the routing table.  If your routing is working fine, then IP spoof drops will work fine.  The 2 examples that you mention route fine now.

If you enable "Strict IP Address Check" then you may have production drops if you have asymmetric routing.

I enable "Spoofed IP address" on all my NGFWs, and it works fine.  I apply my Zone Protection Profile to all my interfaces.

One thing that many people do not know is that these spoofed IP drops along with other packet-based drops are not logged by default.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000wkr7CAA

Here is a good article on troubleshooting spoofed IP drops.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u0000008UuJCAU

Thanks,

Tom

[vishalrsshah]

Thank you for reply.

So it means my reverse natting and server with public ip address in any zone would not be impact by packet based protection

[TomYoung]

Hi @vishalrsshah ,

I cannot comment on specific configuration that I do not know in detail.

If the routing is working correctly now, then "Spoofed IP address" packet protection will not break it.

Thanks,

Tom