About wlu

The Zone Protection doc here covers this Reconnaissance protection on page 4: It states: "Reconnaissance protection is used to prevent/alert administrators on reconnaissance attempts like ports scans, ICMP sweep. Unlike the flood settings, threshold settings are applicable to hosts in the zone where reconnaissance protection is configured.Interval: Time between successive probes for open ports. For host sweep it is the time interval between successive probes (ICMP/TCP/UDP) to the network" So, Since TCP uses SYN, that should count for TCP, and as far as other protocols ICMP and UDP they do not have SYN packets, but are covered by this protection, so that should also be covered. I hope that makes a little sense. ... View more

hi well, "attack continues" as in the PA console shows that the attack keeps going on and the "action" shows "block-ip" for the next few hours until i notice it and block the connection at the router...   and each attempt does reach the server under attack. the strange thing is this is part of the vultnerabilities profile and it does work for blocking MS-RDP brute force attacks...  but not SMB and FTP brute force attacks...  ... View more

absolutely, I agee and understand your requirement. I just know PAN is working on this to make it more granular maybe in 4.0 ? https://live.paloaltonetworks.com/message/3207#3207 rgds Roland ... View more