PAN-OS® Administrator’s Guide
  • PAN-OS® Administrator’s Guide
  • All Documentation
>
Configure Reconnaissance Protection
Focus
Download PDF
Focus
  1. Home
  2. PAN-OS
  3. Zone Protection and DoS Protection
  4. Configure Zone Protection to Increase Network Security
  5. Configure Reconnaissance Protection
Download PDF

Configure Reconnaissance Protection

Table of Contents

Configure Reconnaissance Protection

Prevent attackers from probing your network for vulnerabilities by configuring reconnaissance protection for IP protocol scan, UDP and TCP scans, and host sweeps.
Malicious actors use various scanning techniques, including port scans (TCP and UDP), host sweeps, and IP protocol scans, to identify and exploit network vulnerabilities. To protect your network against these scans, configure the Reconnaissance Protection settings of a Zone Protection profile. For each scan type, you will specify an action and the conditions that trigger the action. For example, you can block subsequent packets from an untrusted source if the firewall detects 1000 IP protocol scan events from that source within 60 seconds.
The following actions are supported for each scan:
  • Allow—The firewall allows the port scan, host sweep, or IP protocol scan reconnaissance to continue.
  • (Default) Alert—The firewall generates an alert for each port scan, host sweep, or IP protocol scan that matches the configured threshold within the specified time interval.
  • Block—The firewall drops all subsequent packets from the source to the destination for the remainder of the specified time interval.
  • Block IP—The firewall drops all subsequent packets for the specified Duration, in seconds (the range is 1-3,600). Track By determines whether the firewall blocks source or source-and-destination traffic.

PAN-OS

PAN-OS: Prevent attackers from probing your network for vulnerabilities by configuring reconnaissance protection.
  1. Configure Reconnaissance Protection.
    1. Select NetworkNetwork ProfilesZone Protection.
    2. Select a Zone Protection profile, or Add a new profile and enter a Name for it.
    3. On the Reconnaissance Protection tab, select the scan types to protect against.
    4. Select an Action for each scan.
      If you select Block IP, you must also configure the Track By (source or source-and-destination) and Duration options.
    5. Set the Interval in seconds. This option defines the time interval for port scan, host sweep, and IP protocol scan detection.
    6. Set the Threshold for reconnaissance events. The threshold defines the number of port scan, host sweep, or IP protocol scan events that need to occur within the specified time interval to trigger an action.
    7. (Optional) Configure a Source Address Exclusion.
      Source Address Exclusions are IP addresses that you want to exclude from reconnaissance protection. You can specify up to 20 IP addresses or netmask address objects.
      Exclude only IP addresses for trusted internal groups that perform vulnerability testing.
      1. Add the address you want to exclude.
      2. Enter a descriptive Name for the address.
      3. For Address Type, select either IPv4 or IPv6, and then select an address object or enter one manually.
      4. Click OK.
    8. Click OK to save the Zone Protection profile.
    9. Commit your changes.
  2. Apply the Zone Protection profile to the appropriate zones, including zones that connect to the internet.

Technical Documentation

Company

Legal Notices

© 2025 Palo Alto Networks, Inc. All rights reserved.