Packet Buffer Protection (PBP)

[User_707]

We are receiving multiple alerts for Packet Buffer Protection (PBP) being triggered on internal-to-internal and internal-to-external traffic. My understanding is that PBP is primarily intended to protect against DoS attacks, which are typically external-to-internal in nature.
Is it expected behavior for PBP to be triggered by internal-to-internal or internal-to-external traffic? Should PBP be configured to monitor all traffic directions, or is it best practice to apply it mainly for external-to-internal flows? Any insight or recommendations would be appreciated.

[mshekh]

Hi @User_707 ,

Thanks for info, It's completely depends on environment and requirements. You can configure it for internal-internal or internal-to-external traffic.

You can refer the below docs for more details:

DoS and Zone Protection Best Practices

https://docs.paloaltonetworks.com/best-practices/dos-and-zone-protection-best-practices/dos-and-zone...

Baseline CPS Measurements for Setting Flood Thresholds

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/zone-protection-and-dos-protection/zone-d...

Zone protection profiles

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clm9CAC

How to Measure CPS

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/zone-protection-and-dos-protection/zone-d...

How to Verify if Zone Protection is Working

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClhzCAC

https://docs.paloaltonetworks.com/pan-os/11-1/pan-os-admin/zone-protection-and-dos-protection/zone-d...