PAN - Zone Protection

Zone Protection Profiles

paloalto security ddos zone-protection

---

Overview

Zone Protection Profiles defend against reconnaissance, DoS attacks, and protocol-level exploits. Applied at the zone level, they protect all interfaces in that zone.

---

Protection Categories

Category	Purpose
Flood Protection	Defend against DoS/DDoS volumetric attacks
Reconnaissance Protection	Block port scans, host sweeps
Packet-Based Attack Protection	Block malformed packets, protocol violations
Protocol Protection	Limit protocol-specific abuse

---

Flood Protection

SYN Flood

# Enable SYN flood protection
set zone-protection-profile <profile> flood tcp-syn enable yes
set zone-protection-profile <profile> flood tcp-syn alert-rate 10000
set zone-protection-profile <profile> flood tcp-syn activate-rate 10000
set zone-protection-profile <profile> flood tcp-syn maximal-rate 40000
 
# SYN Cookies (recommended for SYN floods)
set zone-protection-profile <profile> flood tcp-syn syn-cookies enable yes

Thresholds:

• Alert rate: Log when exceeded
• Activate rate: Start mitigation
• Maximal rate: Hard cap, drop excess

Other Flood Types

# UDP flood
set zone-protection-profile <profile> flood udp enable yes
set zone-protection-profile <profile> flood udp alert-rate 10000
set zone-protection-profile <profile> flood udp activate-rate 10000
set zone-protection-profile <profile> flood udp maximal-rate 40000
 
# ICMP flood
set zone-protection-profile <profile> flood icmp enable yes
set zone-protection-profile <profile> flood icmp alert-rate 10000
set zone-protection-profile <profile> flood icmp activate-rate 10000
set zone-protection-profile <profile> flood icmp maximal-rate 40000
 
# ICMPv6 flood
set zone-protection-profile <profile> flood icmpv6 enable yes
 
# Other IP flood (non-TCP/UDP/ICMP)
set zone-protection-profile <profile> flood other-ip enable yes

---

Reconnaissance Protection

Port Scan Detection

# Enable port scan protection
set zone-protection-profile <profile> scan tcp-port enable yes
set zone-protection-profile <profile> scan tcp-port action block-ip
set zone-protection-profile <profile> scan tcp-port interval 2
set zone-protection-profile <profile> scan tcp-port threshold 100
 
# UDP port scan
set zone-protection-profile <profile> scan udp-port enable yes
set zone-protection-profile <profile> scan udp-port action block-ip

Actions:

Action	Description
allow	Log only
alert	Log with alert
block	Drop packets
block-ip	Block source IP for duration

Host Sweep Detection

# Block hosts scanning multiple IPs
set zone-protection-profile <profile> scan host-sweep enable yes
set zone-protection-profile <profile> scan host-sweep action block-ip
set zone-protection-profile <profile> scan host-sweep interval 10
set zone-protection-profile <profile> scan host-sweep threshold 100

Block Duration

# How long to block offending IPs
set zone-protection-profile <profile> scan block-duration 3600

---

Packet-Based Attack Protection

IP Header Checks

# Spoofed IP addresses
set zone-protection-profile <profile> packet-based-attack-protection ip spoofed-ip-address enable yes
 
# Strict source routing
set zone-protection-profile <profile> packet-based-attack-protection ip strict-ip-address enable yes
 
# Loose source routing
set zone-protection-profile <profile> packet-based-attack-protection ip loose-ip-address enable yes
 
# Record route
set zone-protection-profile <profile> packet-based-attack-protection ip record-route enable yes
 
# Security option
set zone-protection-profile <profile> packet-based-attack-protection ip security enable yes
 
# Stream ID
set zone-protection-profile <profile> packet-based-attack-protection ip stream-id enable yes
 
# Timestamp
set zone-protection-profile <profile> packet-based-attack-protection ip timestamp enable yes
 
# Unknown options
set zone-protection-profile <profile> packet-based-attack-protection ip unknown enable yes
 
# Malformed packets
set zone-protection-profile <profile> packet-based-attack-protection ip malformed enable yes

TCP Header Checks

# TCP SYN with data
set zone-protection-profile <profile> packet-based-attack-protection tcp syn-with-data enable yes
 
# TCP SYN-ACK with data
set zone-protection-profile <profile> packet-based-attack-protection tcp synack-with-data enable yes
 
# TCP split handshake
set zone-protection-profile <profile> packet-based-attack-protection tcp split-handshake enable yes
 
# Strip TCP timestamp (hides OS fingerprint)
set zone-protection-profile <profile> packet-based-attack-protection tcp strip-tcp-timestamp enable yes
 
# Reject non-SYN first packet
set zone-protection-profile <profile> packet-based-attack-protection tcp reject-non-syn enable yes

ICMP Checks

# ICMP ping ID 0
set zone-protection-profile <profile> packet-based-attack-protection icmp ping-id-zero enable yes
 
# ICMP fragment
set zone-protection-profile <profile> packet-based-attack-protection icmp fragment enable yes
 
# Large ICMP
set zone-protection-profile <profile> packet-based-attack-protection icmp large enable yes

IPv6 Checks

# IPv6 routing header type 0
set zone-protection-profile <profile> packet-based-attack-protection ipv6 routing-header-0 enable yes
 
# IPv6 extension headers
set zone-protection-profile <profile> packet-based-attack-protection ipv6 hop-by-hop enable yes
 
# IPv6 fragment header
set zone-protection-profile <profile> packet-based-attack-protection ipv6 fragment enable yes

---

Protocol Protection

TCP Settings

# Reject TCP segments out of window
set zone-protection-profile <profile> protocol-protection tcp reject-out-of-sequence-tcp enable yes
 
# Maximum segment size
set zone-protection-profile <profile> protocol-protection tcp tcp-max-segment-size <bytes>

---

Apply to Zone

# Attach profile to zone
set zone <zone-name> network zone-protection-profile <profile-name>
 
# Enable packet buffer protection (DoS)
set zone <zone-name> enable-packet-buffer-protection yes

---

CLI Commands

View Configuration

# Show zone protection profiles
show zone-protection-profile
 
# Show zone assignments
show zone
 
# Show specific zone details
show zone <zone-name>

Monitor

# View threat logs (includes zone protection)
show log threat
 
# View flood mitigation status
show dos-protection status
 
# Counter statistics
show counter global filter category zone-protection
show counter global filter delta yes | match zone_protect

DoS Protection Counters

# View current rates
show dos-protection rule
 
# Zone protection stats
show zone-protection-profile <profile> statistics

---

Recommended Profile Templates

Untrust Zone (Internet-Facing)

# Aggressive protection for external zone
set zone-protection-profile untrust-protection flood tcp-syn enable yes
set zone-protection-profile untrust-protection flood tcp-syn activate-rate 5000
set zone-protection-profile untrust-protection flood tcp-syn maximal-rate 20000
set zone-protection-profile untrust-protection flood tcp-syn syn-cookies enable yes
 
set zone-protection-profile untrust-protection flood udp enable yes
set zone-protection-profile untrust-protection flood icmp enable yes
 
set zone-protection-profile untrust-protection scan tcp-port enable yes
set zone-protection-profile untrust-protection scan tcp-port action block-ip
set zone-protection-profile untrust-protection scan host-sweep enable yes
set zone-protection-profile untrust-protection scan host-sweep action block-ip
set zone-protection-profile untrust-protection scan block-duration 3600
 
set zone-protection-profile untrust-protection packet-based-attack-protection ip spoofed-ip-address enable yes
set zone-protection-profile untrust-protection packet-based-attack-protection tcp reject-non-syn enable yes

Trust Zone (Internal)

# Moderate protection for internal zone
set zone-protection-profile trust-protection flood tcp-syn enable yes
set zone-protection-profile trust-protection flood tcp-syn alert-rate 10000
 
set zone-protection-profile trust-protection scan tcp-port enable yes
set zone-protection-profile trust-protection scan tcp-port action alert

---

Troubleshooting

Legitimate Traffic Blocked

# Check counter for drops
show counter global filter category zone-protection severity drop
 
# Check threat logs
show log threat subtype zone-protection

Solutions:

• Increase thresholds
• Whitelist legitimate sources
• Review packet-based protections

No Protection Active

# Verify profile attached
show zone <zone-name> | match protection
 
# Verify profile exists
show zone-protection-profile <profile>

---

Related

• PAN - Threat Prevention Profiles
• PAN CLI - Validate Interfaces
• PAN - NAT Troubleshooting