Great Post @kiwi! Adding to this, I have some remediation options, contingencies, or questions to consider when doing DSRI (Disable Server Response Inspection): Is the traffic secured by other methods without needing to decode the server response? Require Cortex XDR or other endpoint product scanning the file being copied. Do this by creating a HIP check on the VPN device and require a match on XDR being enabled and updated in a HIP Profile. Then create a firewall policy configured with an application match policy for ms-ds-smb, ms-smb-v2, and if supported on your OS, ms-smb-v3. Include in this policy a requirement for the HIP profile created in the previous step. Now, consider this... if you use DSRI, consider the potential impact this might havee on vulnerability protection, not just file blocking and malware protection. Are you doing file blocking? You may not be able to use DSRI if your company mandates DLP or other file blocking policies. This may be obvious but just to reiterate, copying a file from the server to a workstation would not be inspected/scanned with DSRI. This is one reason @Kiwi mentioned it should only be used for trusted servers. What is a trusted server? Is a NAS trusted? If the communication is with a NAS, there may be no endpoint protection on the NAS itself. Thus, leaving you to defend your environment either with the inspection of the firewall or the endpoint transferring the files. My definition of a trusted server is one that is on a supported OS, regularly patched, vulnerability scanned, status monitored, and running endpoint protection EDR or preferably an XDR solution such as Cortex XDR. Do you get that with your NAS? Are you allowing SMBv3 prior to PAN-OS 8.1? If so, you are essentially allowing the SMBv3 protocol to bypass the decoder on your firewall. Note on SMB as mentioned by @kiwi : SMB Improvements with WildFire Support Firewall SMB support now includes SMBv3 (3.0, 3.0.2, and 3.1.1) and has additional threat detection and file identification capabilities, performance, and reliability across all versions of SMB. These improvements provide an additional layer of security for networks, such as data center deployments, network segments, and internal networks by allowing files transmitted using SMB to be forwarded to WildFire for analysis. Because of the way that SMBv3 multi-channel works in splitting up files, customers should disable the use of multi-channel file transfer for maximum protection and inspection of files. As a result, Palo Alto Networks recommends disabling SMB multi-channel through the Windows PowerShell. For more information on this task, please refer to: technet.microsoft.com/en-us/library/dn610980(v=ws.11).aspx
... View more
