Anyone know where Palo is on NAT Slipstreaming V2?

[silvioopt]

Hello,

Just curious if there is a definition for the new variant referenced here: https://www.armis.com/resources/iot-security-blog/nat-slipstreaming-v2-0-new-attack-variant-can-expo...

Thank you!

[OtakarKlier]

Hello,

I could find anything from PAN with searching. I opened a case and will let you know what they tell me.

Regards,

[OtakarKlier]

Here is the reply from TAC:

We released 5 different signatures with Content: 8341 (2020-11-09 UTC).
UTIDs:
59667
59668
59669
59671
59672

[Coldfirex]

Do those cover the v2 variant?

[silvioopt]

Thanks for looking into that, but 2020-11-09 was before Nat Slipstreaming V2 was disclosed (on Jan 26th 2021).

[OtakarKlier]

Good catch. I updated my ticket and will let you know what they come back with.

[OtakarKlier]

From support:

According to all our evidence, the signatures will work for both variants.

Guess we are already covered. It might be good if someone could test this?

[Coldfirex]

FYI these are set to Alert by default.  I just set ours to Drop.

[OtakarKlier]

Hello,

Yes, however if you have your policy set by severity blocking everything medium and higher requires no action:

I always suggest blocking medium and higher. Double checking is a great idea! 

Cheers!

[OtakarKlier]

Here is how I suggest these settings be setup:

Cheers!