Detections
Analytics

6.17 Ensure that a Zone Protection Profile with tuned Flood Protection settings enabled for all flood types is attached to all untrusted zones

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Enable all Flood Protection options in the Zone Protection Profile attached to all untrusted zones. The Alert, Activate, and Maximum settings for Flood Protection depend highly on the environment and device used. Perform traffic analysis on the specific environment and firewall to determine accurate thresholds. Do not rely on default values to be appropriate for an environment.

Setting these values for all interfaces is an approach that should be considered by many organizations, as traffic floods can result from internal testing or malware as well.

Rationale:

Without flood protection, it may be possible for an attacker, through the use of a botnet or other means, to overwhelm network resources. Flood protection does not completely eliminate this risk; rather, it provides a layer of protection. Without a properly configured zone protection profile applied to untrusted interfaces, the protected / trusted networks are susceptible to large number of attacks. While many of these involve denial of service, some of these attacks are designed to evade IPS systems (fragmentation attacks for instance) or to evade basic firewall protections (source routing and record route attacks).

Solution

In the GUI:
Navigate to Network > Network Profiles > Zone Protection > Flood Protection.
Set all settings to 'enabled' with at least the default values.
Navigate to Network > Zones, select each untrusted zone in turn, and set the Zone Protection Profile.

Impact:

Not configuring and applying a Network Zone Protection Profile leaves an organization exposed to common attacks and reconnaissance from untrusted networks.

Not configuring a Zone Protection Profile for internal networks leaves an organization vulnerable to malware, software or hardware causes of traffic flooding from internal sources.

Default Value:

Not Configured

References:

'Understanding DoS Protection' - https://live.paloaltonetworks.com/docs/DOC-5078

'Threat Prevention Deployment Tech Note' - https://live.paloaltonetworks.com/docs/DOC-3094

'What are the Differences between DoS Protection and Zone Protection?' - https://live.paloaltonetworks.com/docs/DOC-4501

PANOS 9.0 Admin Guide - Network Profiles / Zone Protection / Flood Protection : https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface-help/network/network-network-profiles/network-network-profiles-zone-protection/flood-protection.html#

See Also

https://workbench.cisecurity.org/files/2692

Item Details

References: CSCv7|12, CSCv7|13.3

Plugin: Palo_Alto

Control ID: 3e33a42e6ce6b665da5bf650f6b6c0b1d39be1955d32663ed3aa7e1f5e180284