Firewalls protect your
network by assigning resources into zones,
traffic can be allowed or denied between these zones.
Apollo Alto Firewall takes this concept and builds on it with advanced features,
which we'll take a look at here.
Before the advanced off.
We should take a look at what zones actually are in a traditional firewall
security rules in the form of an access control list are applied to interfaces.
Each interface can have one ACL applied for inbound traffic
and one for outbound traffic.
When traffic enters or leaves this interface,
it is checked against the ACL and allowed or denied.
This makes the traditional firewall behave much like a router
zone based firewalls take a different approach.
They view the network in terms of zones or areas.
These areas may be trusted or untrusted
and can contain one or more physical or virtual interfaces.
Security policies
are applied to traffic that passes between different zones.
For example, you might have a zone that's connected to the Internet,
a DMZ zone, and his own that's connected to your local land.
Traffic is evaluated as it passes from one zone to another.
A different set of security policies may even be applied to traffic
as passing within the zone, for example, between different servers
A further advantage is if you have more than one
firewall managed centrally with something like Panorama.
The firewalls can have the same zones, which means they can have the same
security.
And that policy is applied based on the zone.
Zones make firewalls more flexible.
Not only can we mix and match interfaces within a zone,
but we can create different types of zones.
A tap zone
is used with Spain traffic, also known as port mirroring.
That's where you send a copy of all traffic to an external device
running Wireshark or some other packet capturing tool.
The virtual war zone is quite interesting.
This is where we pay to interfaces together and pass traffic across them.
It's like joining two cables together with a transparent firewall in between.
This is sometimes called a bump in the wire
in a layer two zone.
The firewall acts like a switch,
but still applies security policies to traffic passing through.
It interfaces in a layer two zone do not have IP addresses
configured on them.
Alliance free zone is probably the most common.
This is where interfaces are configured with IP addresses.
So the firewall can act a bit like a router.
You need to consider routing protocols, either dynamic or static
with this own type.
And finally, there's the external zone type.
This is used if you have multi voices enabled.
That is, the firewall is partitioned into multiple virtual instances.
This is more complicated and is beyond the scope of this video.
When we create zones, we add interfaces to them.
An interface can be a member of one zone only.
However, a zone can have several interfaces,
including interfaces of different types.
By default, all traffic is allowed within a zone.
This is called into a zone traffic.
Traffic between different zones called into zone.
Traffic is denied by default.
Of course we can change all of this using security policies.
The only real rule here is that for passing traffic
between zones, those two zones have to be of the same type.
For example, both layer three zones.
Most of
what we've talked about is fairly common to all vendors.
They might have different names or abilities,
but the concepts are fairly similar.
But on Palo Alto Firewall, there are a few more advanced features,
one of which is a zone protection profile.
The point of this profile is to protect the zone from common attacks.
This is similar to Dot's protection,
but is focused on the health of the whole zone.
Not just a particular server.
Flood protection looks out for a flood of packets of a particular type.
For example, too many TCP syn packets which could represent a DDoS attack.
This works by setting alarm activate and maximum values,
which are measured in packets per second across the entire zone.
When the activate value is reached.
Random early drop is activated, which starts dropping a few packets
from an offending session.
As the packet
rate increases, red drops more and more packets
by the time the rate reaches the maximum threshold.
Red is dropping all packets from these offending sessions.
Reconnaissance protection looks out for things like port scans and host sweeps.
There's quite a lot of options in here.
The actions we can see are allow
alert block and block IP If we use block IP, the source
or source destination combination is entirely blocked for a while.
Palo Alto have best practice recommendations on their site
for early settings.
If you want to work through these on your own firewall
packet based attack prevention looks for packets that aren't quite right.
This includes source spoofing, RPF
ICMP fragmentation and so on.
These are configured as a series of drop profiles.
And finally, protocol
protection can be applied to traffic within a zone.
This is a relatively new feature which allows or denies non IP traffic.
This might include traffic like LDP,
CDP and things of this nature.
Some of these features will add low to the firewall, CPU
and memory, so make sure you monitor it well.
The other advanced feature that Palo Alto adds is packet buffer protection.
Network devices have a buffer where packets are stored before they are
processed.
A single session DDoS attack aims to overwhelm the packet buffer,
filling it so no legitimate packets can be processed
when packet buffer protection is enabled.
The firewall monitors
traffic in all zones and how they are using the packet buffer.
Just like the zone protection profile, these are a series of threshold values.
These are configured globally when the packet buffer starts filling
up, red will start dropping packets from the offending sessions.
Once the thresholds are enabled globally, the feature is enabled
on each individual zone or just in the zones that you want it on.
If it's not enabled on the zone, red
will not drop packets from that zone.
I hope you found this to be a good introduction to both zone
based firewalls and the advanced features that make this approach worthwhile.
I hope to see you again soon.