🛡️ Palo Alto Networks Zone Protection: Flood Protection Explained

1. Understanding Flood Protection

Flood attacks aim to overwhelm network resources by sending a high volume of traffic, leading to degraded performance or service outages. Palo Alto Networks' flood protection measures monitor the rate of new connections per second (CPS) and apply thresholds to detect and mitigate such attacks.

2. Configuring Flood Protection Thresholds

For each flood type (SYN, UDP, ICMP, etc.), administrators can set three thresholds:

• Alarm Rate: The CPS threshold that triggers an alert. It's recommended to set this 15-20% above the average CPS rate to avoid false positives.
• Activate Rate: The CPS threshold at which mitigation actions begin. For RED, this is when the firewall starts probabilistically dropping packets. For SYN Cookies, this is when the firewall begins proxying SYN handshakes.
• Maximum Rate: The CPS threshold beyond which the firewall drops all new connections. This should be set based on the firewall's capacity and typical traffic patterns.

Properly configuring these thresholds ensures effective protection without impacting legitimate traffic.

3. Mitigation Actions: RED vs. SYN Cookies

For SYN flood protection, administrators can choose between two mitigation actions:

Feature	Random Early Drop (RED)	SYN Cookies
Mechanism	Probabilistically drops incoming SYN packets based on thresholds.	Firewall acts as a proxy, completing the handshake on behalf of the server.
Impact on Legitimate Traffic	May drop legitimate connections under high load.	Preserves legitimate connections by only dropping incomplete handshakes.
Resource Consumption	Lower resource usage.	Higher CPU and memory usage due to proxying.
Use Case	Environments with limited resources or where occasional drops are acceptable.	Environments requiring high accuracy and minimal impact on legitimate traffic.

Choosing between RED and SYN Cookies depends on the specific network environment and resource availability.

4. Best Practices

• Baseline Traffic: Monitor and understand normal traffic patterns to set appropriate thresholds.
• Start with Alerts: Initially configure profiles to alert without dropping traffic to fine-tune settings.
• Monitor Resource Usage: Regularly check firewall CPU and memory utilization, especially when using SYN Cookies.
• Adjust Thresholds: Continuously refine thresholds based on observed traffic and attack patterns.

5. Additional Resources

• Flood Protection - Palo Alto Networks Documentation
• Deploy DoS and Zone Protection Using Best Practices