Palo Alto Networks Knowledgebase: How to Configure a Policy with DoS Protection to Protect Hosted Services

How to Configure a Policy with DoS Protection to Protect Hosted Services

5309
Created On 02/07/19 23:44 PM - Last Updated 02/07/19 23:45 PM
Policy
Resolution

Overview

The Palo Alto Networks firewall is configured to host a service. For this example, the firewall is configured to perform destination NAT towards a web server in the Trust network. A policy is now needed for protection against DoS attacks.

DOS_Protection_Topology.jpg

Steps

    1. Create a custom DoS Protection Profile
      1. Navigate to Objects > DoS Protection
      2. Click Add
      3. Configure the DoS Protection Profile (see example below)

        DOS_Protection_Profile.JPG

        DOS_Protection_Policy_3.JPG

    2. Create a DoS Protection Policy using the profile created in step 1.

      1. Navigate to Policies > DoS Protection

      2. Click Add to bring up a new DoS Rule dialog

      3. Associate the Dos Protection profile created earlier

      4. Set the action to Protect. Default action is Deny, which will deny all traffic matching this flow.

        DOS_Protection_Policy_2.JPG

        DOS_Protection_Policy.png

Note: The example from above reflects lab environment values for the thresholds. When deploying the setup in production, the values need to be in accordance to the traffic that is expected to be handled by the network.

owner: sberti



Attachments
Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CloxCAC&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Attachments
Choose Language