Configure Packet Based Attack Protection

Create a Zone Protection profile and configure Packet-Based Attack Protection settings.
Select
Network
Network Profiles
Zone Protection
and
Add
a new profile.
Enter a
Name
for the profile and an optional
Description
.
Select
Packet Based Attack Protection
.
On each tab (
IP Drop
,
TCP Drop
,
ICMP Drop
,
IPv6 Drop
, and
ICMPv6 Drop
), select the Packet-Based Attack Protection settings you want to enforce to protect a zone.
Click
OK
.
Apply the Zone Protection profile to a security zone that is assigned to interfaces you want to protect.
Select
Network
Zones
and select the zone where you want to assign the Zone Protection profile.
Add
the
Interfaces
belonging to the zone.
For
Zone Protection Profile
, select the profile you just created.
Click
OK
.
Commit
your changes.
(
PAN-OS 8.1.2 and later releases
) Enable the firewall to generate Threat logs for a teardrop attack and a DoS attack using ping of death, and also generate Threat logs for the types of packets listed above if you enable the corresponding packet-based attack protection (in Step 1). For example, if you enable packet-based attack protection for
Spoofed IP address
, using the following CLI causes the firewall to generate a Threat log when the firewall receives and drops a packet with a spoofed IP address.
Access the CLI.
Use the operational CLI command
set systemsetting additional-threat-log on
. Default is
off
.
To display the Threat name in the Threat log, you must use content update version 8027 or later; otherwise, the Threat ID number displays in the log.