Information
For all zones, attach a Zone Protection Profile that is configured to drop packets with a spoofed IP address or a mismatched overlapping TCP segment, and packets with malformed, strict source routing, or loose source routing IP options set.
Rationale:
Using specially crafted packets, an attacker may attempt to evade or diminish the effectiveness of network security devices. Enabling the options in this recommendation lowers the risk of these attacks.
Solution
Navigate to Network > Network Profiles > Zone Protection > Zone Protection Profile > Packet Based Attack Protection > TCP/IP Drop.
Set Spoofed IP address to be checked.
Set Mismatched overlapping TCP segment to be checked.
Under IP Option Drop, set Strict Source Routing, Loose Source Routing, and Malformed to all be checked. Additional options may also be set if desired.
Impact:
Not configuring a Network Zone Protection Profile leaves an organization exposed to common attacks and reconnaissance from untrusted networks.
Default Value:
Not Configured
References:
'Understanding DoS Protection' - https://live.paloaltonetworks.com/docs/DOC-5078
'Threat Prevention Deployment Tech Note' - https://live.paloaltonetworks.com/docs/DOC-3094
'What are the Differences between DoS Protection and Zone Protection?' - https://live.paloaltonetworks.com/docs/DOC-4501
PANOS 9.0 Admin Guide - Network Profiles / Zone Protection / Packet Based Attack Protection: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface-help/network/network-network-profiles/network-network-profiles-zone-protection/packet-based-attack-protection.html#