Packet Buffer Protection
Protect the firewall’s packet buffers from single-session DoS attacks that attempt to take down the firewall.
Packet Buffer Protection defends your firewall and network from single session DoS attacks that can overwhelm the firewall’s packet buffer and cause legitimate traffic to drop. Although you don’t configure Packet Buffer Protection in a Zone Protection profile or in a DoS Protection profile or policy rule, Packet Buffer Protection defends ingress zones. While zone and DoS protection apply to new sessions (connections) and are granular, Packet Buffer Protection applies to existing sessions and is global.
You Configure Packet Buffer Protection globally to protect the entire firewall and also enable Packet Buffer Protection on each zone to protect zones:
- Global Packet Buffer Protection—The firewall monitors sessions from all zones (regardless of whether Packet Buffer Protection is enabled in a zone) and how those sessions utilize the packet buffer. You must configure Packet Buffer Protection globally () to protect the firewall and to enable it on individual zones. When packet buffer consumption reaches the configuredDeviceSetupSession SettingsActivatepercentage, the firewall used Random Early Drop (RED) to drop packets from the offending sessions (the firewall doesn’t drop complete sessions at the global level).
- Per-Zone Packet Buffer Protection—Enable Packet Buffer Protection on each zone () to layer in a second level of protection. When packet buffer consumption crosses theNetworkZonesActivatethreshold and global protection begins to apply RED to session traffic, that starts theBlock Hold Timetimer. TheBlock Hold Timeis the amount of time in seconds that the offending session can continue before the firewall blocks the entire session. The offending session remains blocked until theBlock Durationtime expires.If you don’t enable Packet Buffer Protection globally, it won’t be active in zones until you enable it globally.
Take baseline measurements of firewall packet buffer utilization over a period of time—at least one business week, but a longer measurement period provides a better baseline—to understand typical usage. One method of taking baseline measurements is to use a script to automate packet buffer monitoring, which also provides a good method for continuous monitoring and helps you understand when anomalous events occur. Your Palo Alto Networks account team can provide a sample script you can use to develop your own script.
If baseline measurements consistently show abnormally high packet buffer utilization, then the firewall’s capacity may be undersized for typical traffic loads. In this case, consider resizing the firewall deployment. Otherwise, you need to tune the Packet Buffer Protection thresholds carefully to prevent impacted buffers from overflowing (and to prevent dropping legitimate traffic). When firewall sizing is correct for the deployment, only an attack should cause a large spike in buffer usage.
Overrunning the firewall packet buffer negatively impacts the firewall’s packet forwarding capabilities. When the buffers are full, no packets can enter the firewall on any interface, not just the interface that experienced the attack.
The best practices for setting the thresholds are:
- AlertandActivate—Start with the default threshold values (50% in both cases), monitor packet buffer utilization, and adjust the thresholds as necessary. If the firewall is sized correctly, buffer utilization should be well below 50%. If the packet buffer utilization crossesAlertthreshold, the firewall creates an alert entry in the System log.
- Block Hold Time—When packet buffer utilization triggers theActivatethreshold, theBlock Hold Timesets the amount of time the offending session can continue before the firewall blocks the session. During theBlock Hold Time, the firewall continues to apply RED to the packets of offending sessions. Start with the defaultBlock Hold Timethreshold value (60 seconds), monitor packet buffer utilization, and adjust the threshold as necessary. If the packet buffer utilization percentage falls below theActivatethreshold before theBlock Hold Timeexpires, the timer resets and doesn’t start until theActivatethreshold is crossed again. Increasing theBlock Hold Timeimposes a greater penalty on offending sessions and reducing it imposes a lesser penalty on offending sessions.
- Block Duration—When theBlock Hold Timeexpires, the firewall blocks the offending session for the period of time defined by theBlock Duration. Start with the default threshold value (3600 seconds), monitor packet buffer utilization, and adjust the threshold as necessary. When you enable Packet Buffer Protection on a zone,Block Durationaffects every session from the IP address even if only one session from an IP address overutilizes the packet buffer. If you believe that blocking an IP address for one hour (3600 seconds) is too great a penalty, reduce theBlock Durationto an acceptable value.
In addition to monitoring the buffer utilization of individual sessions, Packet Buffer Protection can also block an IP address if certain criteria are met. While the firewall monitors the packet buffers, if it detects a source IP address rapidly creating sessions that would not individually be seen as an attack, it blocks that IP address for the configured
Network Address Translation (NAT) (an external source that has translated its internet-bound traffic using source NAT) can give the appearance of greater packet buffer utilization because of IP address translation activity. If this occurs, adjust the thresholds in a way that penalizes individual sessions but doesn’t penalize the underlying IP addresses (so other sessions from the same IP address aren’t affected). To do this, reduce the
Block Hold Timeso the firewall blocks individual sessions that overutilize the buffers faster, and reduce the
Block Durationso that the underlying IP address is not unduly penalized.
Configure Packet Buffer Protection
Configure Packet Buffer Protection You configure Packet Buffer Protection Protect the firewall’s packet buffers from single-session DoS attacks that attempt to take down the firewall. ...
Session Settings The following table describes session settings. Session Settings Description Rematch Sessions Click Edit and select Rematch Sessions to cause the firewall to apply ...
Deploy DoS and Zone Protection Using Best Practices
DoS and Zone Protection deployment best practices help to ensure a smooth rollout that protects your network and your most critical servers. ...
Configure Session Settings
Configure Session Settings This topic describes various settings for sessions other than timeouts values. Perform these tasks if you need to change the default settings. ...
DoS Protection Profiles
Protect groups of devices and critical individual devices from flood attacks, and limit the maximum concurrent sessions for resources. ...
Monitor Block List
Monitor Block List There are two ways you can cause the firewall to place an IP address on the block list: Configure a Vulnerability Protection ...
Multiple-Session DoS Attack
Multiple-Session DoS Attack Configure DoS Protection Against Flooding of New Sessions by configuring a DoS Protection policy rule, which determines the criteria that, when matched ...
Objects > Security Profiles > DoS Protection
Objects > Security Profiles > DoS Protection DoS Protection profiles are designed for high-precision targeting and they augment Zone Protection profiles. A DoS Protection profile ...
Protect your data center web servers and the firewall from DoS attacks to prevent attackers from taking down your data center network. ...