Palo alto next generation firewall
Palo alto is a next gen firewall with user-id and app-id. Dynamic lists/feeds (EDL) for blocking malicious traffic and allowing trusted traffic like azure and CDNs etc.
It can do its inspections on north/south traffic and east/west traffic. Even on L2/virtual wire connections.
It has IPS, URL, wildfire (unknown threats).
DNS sinkhole (DNS protection)
Advanced logging with cortex data lake (take in multiple log sources and apply machine learning)
Platforms
- Virtual machines for public and private cloud (you control the VM)
- Prisma access (hosted cloud based firewall as a service)
- Physical devices (physical boxes to install on site)
https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations
SP3
Single pass simultaneous:
- traffic inspection
- classification
- enforcement
all in one pass
Control plane (mgmt)
Data plane (traffic)
- Signature matching
- security and network processing
If network gets hammered our control plane is still good and we can access our web interfaces to investigate and resolve the issue
Management options
- Web interface HTTPS over the network or MGMT port
- CLI via SSH over the network or via console cable
- Panorama - centralized platform for managing multiple firewalls. Good for MSP. 6+ devices.
- API - XML REST based API. Good for automation and network programming
The management GUI on box help
There is an onbox documentation, usually in the top right
ACC - Application Command Centre
Analytical tool to provide actionable intelligence about network activity. Shows trends etc.
Monitor tab
Policies
Objects- Setup objects for use in policies
Network
- data plane interfaces and zones
- VPN related items
Device
- General settings
- Management interface
- User accounts
- Licenses
- Config backup
Management port is part of the control plane
Default 192.168.1.1/24
HTTPS
default user: admin/admin
We can disable it if needed and use network interface
By default dataplane ports won't accept mgmt packets
Service routes
For all items we need to reach out of the firewall for eg radius / log forwarding etc.
By default it will use the mgmt port
Device > Setup > Services > Service Router Configuration > Customize
Lots of these settings are not sync'd like NTP so have to config on both palo1 and palo2
Don't forget to set timezone
CLI modes
- Operational - basic network commands: ping traceroute, show, debug
- Configuration - configure command, now you can make changes
- Similar to cisco in that regard
CLI enhancements
- User find to figure out the command syntax
- use ? to get help
- User tab to autocomplete
- Use | pipe with "match" or "except" for output filtering
ping "tab"
We will sett options with symbols
+ count - plus means it needs a value
* host - * means its required
> - means you will have more options after
ping host 1.1.1.1
tail - useful for log messages
set is how we do some config
show is how we show the config
Find all the commands related to the network
find command keyword network
W can see ethernet is under interface under network. To change ethernet1/1 from cli we need to use:
set network interface ethernet1/1
CLI is good for checking and debugging but most config will be done via CLI now
Firewall maintenance
Config files
Running config (running-config.xml)
sits in the dataplane and this one controls the firewall behaviour
When the firewall reboots this config is loaded when it boots up
Candidate configuration (snapshot.xml)
Separate file/space in memory to store temporary configuration in the control plane
Its config we have configured but have not deployed yet.
When we do a commit its merged into running config.
Saving the candidate config doesn't commit the changes
Candidate config is the running config + the new changes
Commit command merges the changes from candidate config into running config
New updated running config has the new changes
We can revert to last saved conf
Replaces current candidate config with a saved candidate config file
We can revert to running config (probably will use this one most)
Get rid of un-commited changes
Load
over writes with a file saved earlier (usually from a backup, used when restoring)
Save
Can save a named config snapshot.
Export
Export a named config (backup)
Dynamic updates
- Make sure these are enabled and auto downloading / installing
- Antivirtus / Wildfire
- Apps and threats
- Global protect HIP
- PAN-DB URL filtering (may use umbrella instead)
Palo alto policy types
- Security (firewall rules etc)
- NAT (global NAT, NoNats, public NATs etc)
- QoS (voice QoS)
- Policy based forward (PBR)
- Decryption (SSL)
- Authentication ( radius / SAML etc)
- DoS protection
- Tunnel Inspection
- SD-WAN
Palo alto works like ASA
works from top to bottom
when rule is match traffic is dispatched
it doesn't check any futther rules
Security policies
- The primary traffic control tool
- Block rules at top like block lists, implicit deny at the bottom.
- Add the most specific rules at the top
IntERzone vs IntRAzone
- IntERzone (lan to dmz)
- IntRAzone (same zone)
- Universal (interzone + intrazone combined)
Application/Service
- select (pick which ports)
- any (allow HTTP on any port for example)
- application-default (web-browsing only allowed on default ports 80/443 but not 8881)
Generally we don't want to allow apps on lots of ports but some custom applications run HTTP etc on non standard ports.
- applicaiton-default - use this where we can as first preference
- select - in edge cases we can config the specific ports. Second choice.
- any - only for testing or we can't get it working any other way. Last resort.
Default rules can be changed by using the override button.
Policy objects / groups
Its efficient to group items into groups so later the groups can be updated but your firewall rules can remain unchanged.
Security profiles
ping command source from inside to host
ping source 192.168.10.100 host 192.168.10.50
however if the clients try to ping the firewall it will fail by default. We would need to create a management profile, allow ping and apply it to that interface.
ACLs can be found under
Policies > Security
We can see applications ping and icmp
icmp is for the full protocol (except for ping)
ping is the ping app which is under icmp protocol
How to block web comms to a specific IP
NAT
- Allows network devices to change source/destination of packets.
- Main function for IPv4 depletion but has other uses.
- In most orgs its used to hide all clients behind a single IP for internet access (NAT overload)
- The other main use is to give servers a static public IP
- NoNAT's are used for S2S VPNs
SNAT - source NAT
DNAT - destination
Some devices allow changing source and destination at the same time
Static NAT is to map one IP to one IP
Dynamic is IP that gets mapped can come from pool of IP's. Dynamic includes port translations
On palo alto we have a NAT policy
- A NAT rule has 3 main sections:
- General
- Original packet
- Translated packet
NAT type: IPv6 / IPv6
Original packet is how we select the original packet
Translated packet is what we want to change it to
Rules can refer to address objects instead of IPs
It's recommended to use objects in case the IP is updated later.
- NAT Rule processing is top down
- Applies regardless of NAT type
- Most specific rules at top
- More general NAT's at the bottom
- No NAT rule can go at the top (exemptions)
IP addresses should always refer to the original IP's, pre-NAT
Use the original IP in the firewall rules as well.
Remember NAT does the translation but it doesn't allow or deny anything. That is the job of the security policy.
test routing fib-lookup virtual-router default ip 192.168.57.31
Will give you the interface it will go out.
show routeing route
Shows all routes
Working with NAT
Policies > NAT
In some cases we might need to adjust routes
For example when you need to NAT to an external IP block
In the case there is one public IP range configured on the outside of the firewall
A second block/pool has been added on later. In this case the firewall doesn't know about it.
Like an extra IP block
You may need to adjust routing so traffic knows how to get back to the firewall.
Verify and TS
Device > troubleshooting > NAT policy match
Rule usage, check hit counts / last hit / fist hit
CLI
- show session all
- show running ippool
- show system state | match nat
Goal is to enable dynamic NAT with a pool for any inside network
This will be source NAT (SNAT)
As the traffic leaves we will change the source to something else
First create your object with your public IP pool.
Name: DPOOL
IP netmask: 192.0.2.0/24
Policies > NAT
Add rule
Give a name
SRC: IN
DST: OUT
Go to translated packet
Change source to dynamic IP
select: DPOOL
NAT policy doesn't automatically allow the traffic. You will need a security policy rule as well.
You may need to have a route setup to route back.
Goal expose a DMZ device to the internet
This will be destination translation from outside to outside
Palo NAT works on addresses and zones from the original packet, that is why we do outside > outside and not outside > dmz.
NAME: STATIC
SEC: OUT
DEST: OUT
DEST ADDR: 102.0.2.230
Translated packet
Source translation: none
Destination translation type: static IP
Translated address: 192.168.57.31
We don't need bi directional here because the firewall will allow the return traffic.
Again you will need security policy to allow the traffic
In the security policy it applies after translation. So we will need OUTSIDE > DMZ, even though the address belongs to outside.
NAT policy: original packet (outside to outside)
Security policy: after translation (outside to DMZ)
Logging and monitoring
logs are timestamped events, often including useful information src/dst IP etc.
Important log types but there are more
- Traffic - src/dst IP, ports, app, nat
- Threat - details on detected threats
- Config/Audit - what changes admin made
- System - the PAN os system
- User-ID - details about user ID
- Global protect - the dial in VPN logs
Log settings
- Session start - log at the first packet (useful for UDP and sessions that never fully setup/close)
- Session end - log when the tcp connection has closed
- Log forwarding - send logs to external syslog server/SIEM etc. The firewall can only store so much.
- Logs can be filtered
- Log profile defines the external log server
- Log forwarding is where we define what logs we will send
Enhanced logging
We can collect additional data for cortex XDR. You need data lake subscription
Config
Device > server profiles > syslog
Add profile
SYSLOG-PROF
fill in IP of syslog server 192.168.100.50
Device > Setup > Services
Make sure you use the right interface for syslog, often picking inside/lan interface
Objects > Log Forwarding
LOG-FWD
pick traffic and select SYSLOG-PROF
Log settings
under config logs do the same
In our rules set the logging settings as needed (session start vs session end)
If we need to override the default rule, log at session end
Set log forwarding
Policies
App-ID
We need app ID for modern threats
Different protocols can be listening on different ports 443/80/22
When the palo see's a connection on port 80 for example it will check that its TCP and that its HTTP protocol. Now it knows its actually HTTP traffic running on its standard port so can be allowed/blocked.
If the connection shows TCP but SSH protocol then the connection could be blocked as it won't match the application rule.
Similarly if we see TCP and HTTP protocol but the port is 8080 the palo will also block if its set to look for application default ports. This can be changed in the firewall rule settings
Advanced policies
QoS - a set of tech that we can enable to control traffic bandwidth/latency/jitter etc.
Palo can do classification on packets based on the user and app
Bandwidth mgmt - limit/guarantee bandwidth for certain apps/flows
Priority queuing - voice traffic gets processed first
example classification
- voice/teams
- business critical apps
- everything else
Default profile is just for prioritization
Policies > QoS
Class 4 is the default
We can use DSCP and/or ToS marking that may have been done by other netwok devices and honor them or change them as you need
Use post NAT address in QoS (like in security access policy)
QoS is processed top down and exits on rule match
QoS is outbound/Egress feature. Affects outbound interface only
To limit downloads from the internet, apply QoS in inside interface (egress to inside/LAN)
To limit uploads , apply QoS to outside interface (egress to internet)
Turn QoS on the interface
Physical vs clear text vs tunnelled interface
Egress max is the max speed of the interface.
If a class has egress max 0, the value of egrees max will be used
When we guarantee bandwidth its only kicking in, in the event of congestion
Classes with no guarentee'd bandwidth will show a guarantee of 0.001 mbps
Steps
Create QoS policy
Create QoS profiles
Don't forget to commit
After applying check the statistics
Decryption
Decryptions allows the firewall to look inside encrypted connections like HTTPS connections
We may detect malware coming across the encrypted flow and we can block
If we don't decrypt we are not able to detect it in transit and would hope the endpoint AV will catch it
Some traffic can't / shouldn't be decrypted
SSL/TLS decryption (man in the middle)
SSL forward proxy (outbound traffic)
Certs needed:
- Forward trust
- Forward untrust
Client < > (SSL decrypt) FW (SSL decrypt) < > internet > Server
- When client starts a connection, the firewall intercepts the connection setup
- The firewall impersonates the server.
- The firewall does the same to the server, impersonates the client
- The client thinks its talking to the server but its talking to the firewall
- The server thinks its talking to the client but its talking to the firewall
- The firewall joins both ends but is able to look inside the connection
SSL Inbound inspection
Applies to inbound traffic, usually to your public servers
Internet > HTTPS > FW > DMZ > Web server
In this method we install the certs from our servers on the firewall.
SSH decryption
We don't need certs
Useful to find people using SSH port forwarding x11 or TCP connections
Decryption mirror
We can copy decrypted traffic to a destination on an interface. The traffic gets sent 1 way out to be logg or inspected by another system
Decryption broke
Firewall still decrypts but only sends the allowed traffic to other devices for additional inspection
FW > C-TXT > SC1 > SC2 > remaining allowed traffic goes back to the firewall
Decryption exclusions
Some apps can't be decrypted. Some compliance / regulation means we can't decrypt banking and health data as its private.
Decryption certs
- Forward trust cert - needs to be trusted by enpoints
- Forward untrust cert - should not be trusted because we want to represent untrusted destinations
- SSL inbound certs will - install the certs/private key from your pubic servers on the firewall
Decryption profile
We can set extra options on how to handle sites that have expired or old ciphers etc
Define sites to decrypt by zone, user, but you will probably use URL category the most
In new infra make a NoDecrypt URL category and choose to decrypt everything else.
For existing infra you will want to move gradually, start with some non critical sites or test users
Device > certificate management > SSL decryption exclusion
Disable decryption temporarily via CLI
- set system setting ssl-decrypt skip-ssl-decrypt yes
The command applies immediately, does not need commit. You can test your site/rule ssldecrypt in/out of your issue
Turn it back on
set system setting ssl-decrypt skip-ssl-decrypt no
Checking logs in the GUI:
Checking logs on the CLI:
- show session all filter ssl-decrypt yes
- show counter global | match proxy
If the session is decrypted we should see a * in the flag field. If its blank we did not do decryption
ACTIVE FLOW * 192.168.100.50
SSH decryption
Create a decryption policy with the action set to SSH proxy
To see if SSH is tunneling traffic we need to decrypt
Normal SSH traffic is SSH, SCP, SFTP
In you security rule allow the the app ssh but block ssh-tunnel
Example rule order
- NoDecrypt / exclusion list
- HTTPS decrypt
- SSH decrypt
Tunnel inspection
Looking at content of cleartext pass through tunnels
- GRE (generic Routing Encapsulation)
- IPsec (ESP with null encryption, AH transport mode)
- VXLAN (virtual extensible local area network)
- GPRS (general packet radio servic)
Why inspect tunnels ?
For example if we allow a GRE tunnel
We allow GRE from tunnel source to tunnel destination
However everything inside the tunnel is allowed (which we might not want)
If we inspect the tunnel and look at the original IP header and payload and inspect it
Then we can allow/block what we want or enforce QoS
Processing logic
- Tunnel must be allowed
- tunnel inspection rules are evaluated from top down
- packets that match a rule are subject to extra validation (eg RFC checks, unknown protocols)
- Encapsulated traffic becomes subject to security policy evaluation
We can also create tunnel zones
inside zone > tunnel zone
This will make it easier to control the tunnelled traffic
For example TIN and TOUT
Logs
- GUI: Monitor > Logs > Tunnel Inspection, ACC > Tunnel activity
- CLI: show session id
Application override
Simplified app id mechanism which overrides App-ID
You might have a custom app that palo alto doesn't know about so there is no App-ID
L7 inspections are abandoned, just l4
Generally not recommended to use it, we should use App-ID or make customer app-id signature.
When used we should try to limit to the client/server that uses.
Why use it
Improved visibility and reporting
The draw back is we will lose L7 inspections
Our app runs on TCP 57188 but we don't want it detected as unknown TCP
show session all filter application
Policy Based Forward (PBF)
Normal routing forwards packets based on the destination
PAN-OS uses virtual routers
PBF allows us to override those default decision by routing
PBF only works with services (port number) don't use apps because PBF happens before L7 stuff.
PBF can use
- source ip
- destination ip
- ports
- zones
- etc
Why use it ?
Dual link/ISPs
- We may want to send our WIFI traffic out our secondary connection, to take pressure off the primary but also a good indicator that the secondary connection is up and working as users will alert us.
- Security
- Load distribution and testing
- Traffic segregation
- PBF can be combined with path monitoring for failure detection
- If ISP link goes down, we can fail back to the default path
CLI show commands:- show routing route
- show routing fib
- test routing fib-lookup ip 192.168.1.10 virtual-router default
- show pbf
- show session id
- test pbf-test-policy-match
Policy optimizer
A tool that to help control and optimize the security rule set
used for rule migration (ports > apps)
find rules that are never matched and duplicates
Device > setup > Management > Policy rule base settings > policy application usage
In general clone the rule
change the services (ports to apps)
You can move the app rule above the port rule and make sure its matched or just disable the old rule and test. After some period of testing you can delete the disabled rules.
App-ID
Objects > Applications
Palo has built in App-ID's in its database
You can customize some info, but some info is fixed
You can also make a custom app-id for bespoke apps
App properties
Category, subcategory
Risk
Technology
Tag (add your own tag)
Characters
Working with applications
App rules > port based rules (because anything can be tunnelled over port 80/443, we need to look deeper)
We should make app rules on top
port rules below
Review the hitcounts and detected applications, work towards removing the port based rules.
If we do have to use a port based rule we can lock it to source/destination
Applicaiton-default
reduces administrative overhead
port-mappings
We can look in objects > applications >facebook and see what ports it uses by default.
We can also look on https://applipedia.paloaltonetworks.com/
Application dependencies
Many applications will rely on another application
Implicit dependencies - will be enabled automatically
Explicit dependencies - requites to be added manually
eg
Facebook requires "http" and "ssl"
Check objects > applications
Check an app
Check the "implicitly uses" (implicit)
Check the "depends on" (explicit)
When adding an app to the rule we should see a list of depends on applications. You can quickly add these to the existing rule.
We can make application groups
objects > application groups
eg
make a app group call social media, then add facebook, instragram, twitter
Now we just need to allow our users access to this group
Similar to applications group is application filter
We say what characteristics/properties make an app part of the filter
eg business-filter
go to category and select business relevance and risk level 1 (most secure)
This may allow apps in the future that you don't intend but also can save you time.
Custom applications
Created for better visibility and granular control
Lets say you have a custom application in your org
It's showing up as unknown-tcp
So we may need to build a custom application
We should have detailed information on how the app works
You may need to do a wireshark on the traffic
User-ID
Classic firewall rules were based on IP's and ports. From a world where everyone was in the office etc.
We would give important clients and servers static IP's and create firewall rules based on those.
Today we try to work off role based access control (RBAC). For example Bob is a member of marketing and everyone in the market team should have access to facebook. We also have users working on WIFI and in remote locations from home etc. User IP's are often given by DHCP on top of that so that makes the old IP based policies no longer sufficient.
Most application firewalls will also be user aware. This is done by connecting the firewall to active directory and the firewall keeps a user to IP mapping. This process is known as user-id. We can now make firewall rules based on the AD username or group. On top of that we will get more information on users in our logging like how much bandwidth they are using etc.
How user ID works ?
The user info is not part of the network traffic. We just see a connection from an IP to www.facebook.com. It can work by several methods.
Group mappings
Firewall collects group mapping info for simplified administration. Eg connect to LDAP server. You will need an AD account to connect.
Global protect user-id
When users log in via the global protect client they type in the username and password. The firewall can record who the remote user is at that point. This is why you will often see user-id is working for remote clients but LAN clients it hasn't been enabled yet.
Windows agent
Software installed on the DC's.
Saves CPU on the firewall MGMT plane.
Needs some bandwidth has agent must send data to the firewall
Software has to be installed/updated on the DC
Integrated agent (or agentless)
built into the firewall
Reduces bandwidth usage
Server monitoring
analysis of the event logs
Syslog
analysis of syslog login/logout
Port mapping
For multi-user system, such as terminal services or citrix
XFF headers
X forwarded for header will be there if a proxy server is in use
Auth with Captive portal
All the other methods are passive, the user doesn't have to do anything.
Captive portal is the only active method.
This is where the user gets a pop up to enter their username and password
Works with Kerberos SSO, NTLM, Client cert. More than one method can be used.
Captive portal modes
transparent - good for L2 or Vwire deployments
redirect - Firewall does 302 redirect to original request, better user experience
General overview
- Enable User-ID in the right zone (GP and LAN etc)
- Map IP address to users (with one of the methods, usually passive server monitoring)
- Create user ID rules (create your firewall rules based on app and user roles)
Deploying authentication
Server profile
- Device > Server Profiles > LDAP
- Add our server IP and port 389
- Type will be active directory
- Base DN, DC=domain,DC=int
- Bind DN admin@domina.int
- password: secret-strong-password-here
Group mapping
- Device > User ID > Group Mapping settings
- Add mapping
- Choose the server profiles
- Choose the group from AD
- Instead of fetching all AD groups we can choose
- Most deployments we will want to bring in all groups
- This is also a good test to see if the server profile is working
Auth profile
Device > Authentication profile
Add
type LDAP
Server profiles (select profile created above
User Domain ( domain )
*** if you leave this off the users may not match
*** We want domain\user, not just user
CLI commands for checking
show user group list
show user ip-user-mapping
show user ip-user-mapping all
Clearing cache in case of troubleshooting / after fixing a broken AD connection
clear user-cache all
clear user-cache-mp all
clear uid-cache all
delete user-group-cache
Enable user ID on the zone
Network > Zones
Click on Inside zone for example
Tick the enable user ID check box
Service routes
Devices > Setup > Services
Check the settings on LDAP and UID agent are correct
In some cases you will want the LDAP/UID to come from the LAN interface
For captive portal make below
Network > Network profiles > Interface MGMT > Add interface mgmt profile
enable response pages
Enable user ID
This can be used later for captive portal
Portal certificate
- Device > Certificate mgmt > Certificates > Device Certificates
- For self signed make sure to check "certificate authority"
- Bind the server to a SSL/TLS profiles
- Device > Certificate management > SSL/TLS service profiles
When generating the cert
PA-CERT
common name: x.x.x.x (IP of the interface on the firewall eg LAN IP)
check certificate authority box
This cert will need to be trusted by all clients, you can deploy it to GP clients via the firewall
But best to deploy out via GPO or Intune
Device > User identification
Tick enable captive portal
Choose your SSL/TLS profile (one we made above)
Pick redirect mode
Fill in FW inside IP for the portal address
Auth policy for captive portal
Policies > Authentication
Add auth policy rule
Name your rule eg auth-trigger-http
select src and dst (eg inside > outside)
user is unknown
service is service-http
authentication enforcement: default-web-form
Troubleshooting
- Use CLI commands to troubleshoot
- Clear cache and retry connections, is the mapping working ?
- Ensure you can reach your AD servers from the right interface
- Ensure your AD user account is valid, has rights and correct password
- Ensure you mappings are correct domain\user vs user
Security profiles
Security profiles are extra security inspection engines which can be applied for extra security on allow rules. They won't do any thing on deny rules as the traffic will already be dropped.
Profile types
- Antivirus - classic AV based off signatures (some may be created by wildfire)
- Antispyware - detects C2 traffic such as beaconing
- Vulnerability protection - Similar to IPS, detects known SQL injects, RCE etc.
- URL filtering - URL content/category filtering (DNS protection)
- File blocking - Block by file type .pdf. Does not care if the file is malicious or not.
- Data filtering - Stop data exfil such as credit card numbers / certs / keys etc. Basic DLP.
- DoS protection - Protects against floods and session exhaustion, rate limit etc.
- Wildfire analysis - Like AMP on cisco land. It forwards unknown/suspicious samples to cloud for analysis in sandbox. It is used by palo alto to produce new signatures that feed back into antivirus profile. The AV/AS profiles are the ones that do the blocking.
Actions
We can set various actions like
- Allow
- Drop
- Alert (log)
- Reset (client / server / both)
- Default
Antispyware has extra actions
- Block IP - block the C2 IP for some time
- DNS sinkhole - redirect the C2 traffic to some server so it can be dropped or monitored. If all infected devices start reporting in you can clean them from your network.
URL filtering has extra actions
- Continue - display a warning page before letting the user continue
- Override - allow access to the page if an authorized user authenticates
In reality I would say not much use for these. Either allow or block these pages based on company policy.
Default vs Strict
Default will go with the suggested action in the signature
Strict will always block high and critical signatures
BPA
Will want you to set the strict value which blocks all high/critical signatures in all cases.
Wildfire vs antivirus (signatures) and antispyware (c2 beacons)
In practice: WildFire analyses an unknown file and identifies it as malware. Antivirus can then block that file using the resulting signature. If a host was already infected, Anti-Spyware can catch its attempts to reach out to the attacker.
Exam tip: A WildFire Analysis profile forwards files for analysis but doesn’t block them. Blocking comes from other controls, such as the Antivirus profile’s WildFire action.
A note on SSL decryption
The majority of these profiles need SSL decryption on to be effective as they are lookin inside the payload. Obviously clear text stuff like HTTP can be protected without SSL decrypt but majority of traffic today is encrypted.
DoS protection is the only one because it uses traffic and session rates no payload inspection.
We can apply the profiles in the actions tab on a firewall rule.
We can apply each one for granular control, but in most cases you will have a standardized set of rules. In that case you can use a security profile group.
Set all the settings in a group and apply the group to the firewall rule. That way you don't have to select each profile individually.
Security profile groups
Generally you will have a company policy. You can config all your security profiles according to company policy. Once completed you can make a security profile group which uses all of them. Now you can apply one group to all your rules and have all company polices applied. If you use the default group it will automatically apply to all new rules. So some time investment up front in building these profiles will pay off later.
DoS attacks
What is a denial of service attack ?
Any type of attack that renders a network / device / service unusable. They can cause websites to crash / WIFI AP's not to accept new clients / Claim all the IP addresses from a DHCP server so no new clients can connect etc. There are many types of DoS attack and many different methods but the end goal is the same. Two main types are flood based (send lots of packets) or crash based (exploit / bug / vuln) which will crash the device or cause a reboot.
Often they are considered less risk than a remote code execution because generally the attacker doesn't get access to anything, they just break things. However the impact does depend. If your website needs to be up for the company to make money or its a hospital system. Sometimes DoS attacks are used to put the server into a crashed state where it will accept commands which can give the attacker access. For these reasons its important we protect against DoS attacks.
High volume DDOS attacks.
Your internet connection is usually of a fixed size. Likewise your firewall hardware resources are limited. Attackers can use botnets and DNS reflection attacks to fill your connection/hardware.
For these reasons a layered approach is recommended
Internet - put cloud flare out in front of your web sites DNS names. You will need to take care not to expose your real server public IP's via your website code and server software.
Next layer is your perimeter device (palo) with hardware based ACLs and stateful firewall. Palo recommend to place the firewall as close to the servers its protecting as possible. Its not always feasible based on cost.
Web server based protection. For example nginx has some abilities to absorb slow connections and request floods from induvial IPs. It can't help with volumetric attacks. See Fail2Ban and CrowdSec. WAF can filter applications but we can use WAF at cloudflare level.
Preparing a baseline
If we set zone protection with default numbers it might work but it could be too high or too low. Its a good idea to create a baseline for a week or month.
How to get the numbers ?
Panorama
Panorama > Managed Device > Health > All devices
SNMP MIBS (can be monitored by monitoring tools)
CPS is connection per second
PanZoneActiveTcpCps
PanZoneActiveUdpCps
PanZoneOtherIPCps
3rd party monitoring tools
Wireshark, netflow etc
Once we have baseline we can set values for example if normal ops don't go over 2500 then we can set 3000 or even 9000 as a limit. Keep in mind as legitimate traffic grows you may have to re baseline and adjust.
Zone protection
We can put zone protection profiles to the zone for example all packets entering the inside zone.
If we have 2 or more interfaces as part of the inside zone both interfaces are subject to zone protection. This is known as broad protection.
It only applied to new sessions. So if you apply zone protection you may need to clear connection / sessions.
The protection is applied on the way in (ingress).
Web GUI
Network > Network > Profiles > Zone protection
Network > Zones
Add zone protection profile
CLI
show zone-protection
KB
https://docs.paloaltonetworks.com/best-practices/dos-and-zone-protection-best-practices
Flood protection defends against
- SYN
- ICMP
- ICMPv6
- UDP
- And other flood based attacks
Traffic above the connection per second threshold, we take action
RED (random early drop)
In the case of SYN flood protection we can use SYN cookies
Firewall acts as a proxy similar to SSL decryption the firewall is sitting in the middle.
However its memory intense so need to use carefully
Reconnaissance protection
Recognise port scans or host sweeps
Actions
We can also exempt an IP for our own penetration tests. You may need to pair this with a firewall rule. However its not a real world scan if you just let the penetration testers in. Something to be aware of.
Protocol protection (non IP)
- For L2 protocols, you would use this on virtual wires
- LLDP
- STP
- SCADA
- GOOSE
Exclude list will block the protocols you define and allow the rest
Include list will allow the protocols your define and block the rest
This is based on the protocol type code which you will need to know / get from wireshark capture.
DoS protection
DoS protection is granular protection
In general will be flood protection (some resource based attacks)
Aggregate vs Classified
- Aggregate applies to combined traffic (per device group)
- Classified applies to individual devices (per device)
With aggregate you could find your zone is not overloaded but a single server could be over loaded. In those cases you may want to use classified so each server has a profile. You can combine them.
Objects > security profiles > DoS protection
Monitor and adjust thresholds
Eanble resource protections (max concurrent sessions)
Protections rules
Policies > DoS Protection
Actions
- allow
- deny
- protect (classified, need to select protection profile)
DoS protection is processed before the firewall rules.
For classified we want to count on destination IP (our DMZ server)
CLI
show dos-protection
show dos-protection rule RULE1 settings
show dos-protection zone
Advanced Technologies
