Advanced Protection

In this chapter, we will learn about advanced configuration features, such as custom applications and custom threats, and apply them to a policy, and we will review how zone protection and Denial of Service (DoS) protection can defend the network and individual resources from attackers.

In this chapter, we’re going to cover the following main topics:

• Custom applications and application override
• Custom threat signatures
• Zone protection and DoS protection

In the following chapter we will learn how to create custom applications to identify internally created protocols or applications that do not match, or match a generic App-ID. We will also learn how to create our own threat signatures so we can block certain payloads. Lastly we’ll see how we can defend the firewall and backend systems from all sorts of packet-based attacks.

Technical requirements

In this chapter, we will be covering remote connections and protection from inbound connections. If you have a lab environment where you can simulate custom applications and incoming scans or floods, this will help greatly in visualizing what is being explained.

Custom applications and threats

Every once in a while, an application may not be known. This could be due to it being a new application that has not been used much in the wild or could be something a developer created in-house for which it is not reasonable to expect there to be signatures to identify the session.

In these cases, it is possible to create custom applications that use custom signatures and can trigger an App-ID to positively identify the previously unknown application.

The need for a custom application usually starts with the discovery of an abnormality in the traffic log. In the following screenshot, I have discovered my solar power converter, and an IoT device is communicating with its home server over an unknown-tcp connection:

Figure 11.1: An unknown-tcp application in the traffic log

There are two ways to address this issue:

• Implement an application override that forcibly sets all these sessions to a specific application
• Create...

Zone protection and DoS protection

While layer 7 threats generally revolve around stealing data, blackmailing users through sophisticated phishing, or infecting hosts with complex and expensive zero-day vulnerabilities, protecting the network layer against DoS and low-level packet attacks is equally important. Protecting the system and the network is achieved in three different ways:

• System-wide settings that defend against maliciously crafted packets or attempts at evasion through manipulation
• Zone protection to protect the whole network against an onslaught of packets intended to bring the network to its knees
• DoS protection to more granularly protect resources from being overwhelmed

The system-wide settings are, unfortunately, not all neatly sorted in one place. I’ll go over the most important ones.

System protection settings

A good deal of the global session-related settings can be accessed through the Device | Setup | Session tab...

Summary

In this chapter, you learned how to set up site-to-site VPN tunnels and a client-to-site VPN with GlobalProtect. You can now not only provide connectivity but also scan the client machine for compliance and know how to control the user experience. You’ve also learned how to create custom applications and custom threats that will allow you to identify packets unique to your environment and take affirmative action, and we’ve learned how to set up zone and DoS protection to defend against all kinds of packet-based attacks.

In the next chapter, we will be getting our hands on some basic troubleshooting. We will learn about session details and how to interpret what is happening to a session.

If you’re preparing for the PCNSE, remember QoS rules are applied on the egress interface and how the classes apply to different profiles on different interfaces. Remember the implications of using an app override and what the benefits are of a custom application...