Lompat ke konten Lompat ke sidebar Lompat ke footer
Beranda / PaloAlto | Firewall Security

PaloAlto | Firewall Security

Oleh Hasugian Posting Komentar
 
admin@PA-FW-01> test url bbc.com
admin@PA-FW-01> show log url
admin@PA-FW-01> show log data

Cek Quota Hardisk
admin@PA-FW-01(active)> show system logdb-quota
WildFire Verifikasi
admin@PA-FW-01> debug wildfire upload-log show

File Filtering | Berikut Link download File  Filter Berdasarkan extension:
Check File Type PDF

Link Enable DNS Security to control traffic based on domains
https://www.youtube.com/watch?v=fsWwACeJb48

Link Download File EXE (MIkrotik)
https://mikrotik.com/download

Link Check Application Category
https://applipedia.paloaltonetworks.com/









Link Check THREATVAULT
https://threatvault.paloaltonetworks.com/























==================================================
43. DNS Security Test Domain
https://docs.paloaltonetworks.com/dns-security/administration/configure-dns-security/dns-security-test-domains

https://libredns.gr/

















Penerapan di Rules Polices- Security dari Outside ke area Server. Sama satu rules, dan satu object dgn Security-Profile di Anti-Spyware.
==============================================================
44. Anti-Spyware.
Penerapan di Rules Polices- Security dari Outside ke Inside (area Server)
============================================================
45. Data Protection
a. Object | Custom Object | Data Patern | Create Data Object

















b. Object | Security Profile |  Data Filtering , (lalu isi sesuai kriteria )

















c. Lalu terapakan di menu Policies | Security source Inside to Outside. Di Tab Action pilih Data Filtering, pili nama yg sudah dibuat sebelumnya.


















Lalu test akses dari PC/laptop Inside ke PC outside dimana file berisikan NumberCard/ Kartu Kredit. Jika berhasil harusnya ada peringatan (warning).
=======================================================
46. Zone Protection
a. Network | Zone Protection | Add
Buat namanya dan kriterianya ex: Zone_Outside_Protection.















b. Network | Zone. Pilih Zone Outside (ether1/1). Pemilihan bisa saja ke Zone server atau DMZ. Intinya soy melndungi area/zona server.




















Verifikasi :
Test dengan beberapa command dari kali linux ke IP dibawah ini
root@kali:~# nmap -sU -p0-65535 192.168.17.150
root@kali:~# nmap -sP 192.168.17.0/24
root@kali:~# hping3 -c 15000 -d 120 -S -w 64 -p 80 --flood --rand-source 192.168.17.150
root@kali:~# hping3 -1 --flood -a 192.168.17.150 192.168.17.255
root@kali:~# nmap -sU -p0-65535 192.168.17.150
root@kali:~# nmap -O 192.168.17.150

Noted: Di AP1 production diterapkan hanya di zone Outside






















Selesai.
--------------------------------------------------------------------------------------------------------
47. DoS Protection Profile
2. Object | Security Profile |  DoS Protection | Add. Di LAB ini sy buat ada 2 kriteria i.e:    a. Aggregate dan b. Clasiffication). 
 
a. Type-1 - Aggregate
Create DoS Protection dgn  Type Aggregate. Centang SYS-Flood, ICMP-Flood, UDP-Flood, IP Other . (Bisa satu-persatu dicentang, buat testing sj).
























3. Menu Policies | Dos Protection | Add
   -Terapkan dari Outside to Inside , dan di Tab Option/Protection (pilih Object yg baru dibuat DoS Protection, Action = Protect and Commit.








Type-2 - Specification
A. Create DoS Protection, di Tab Other Option Type Classification)
    Centang semua SYS-Flood, ICMP-Flood, UDP-Fbood, IP Other Flood.






























B. Lalu ke menu Policies | Dos Proection
   -Source  Outside  (ip any) TO  Inside (IP, Network) , dan tab OPtion/Pritection.

Classified:
Profile: (pilih yg baru object yg baru dibuat DoS Protection type Classification.
Address: Pilih src-dst-ip-booth. Commit






















Testing Dari Kali Linux
hping3 -c 15000 -d 120 -S -w 64 -p 80 --flood --rand-source 192.168.17.150

Selesai...
==================================================
III. Device | Setup | Session
1. Aktifkan (centang ):
   - Remacth all session
   - Packet Buffer Protection



















===================================================
IV. Interface | Zone
1. Plih Zone Outside, centang Enable Buffer Packet Protection
Lalu test dari Kali linux. Kali linux di outside, server di Outside




========================================================

SYN Floding
Kalilinux#kali:~# hping3 -c 15000 -d 120 -S -w 64 -p 80 --flood --rand-source 192.168.114.50
   
UDP FLooding
Kalilinux#kali:~# nmap -sU -p0-65535 192.168.114.50

ICMP FLooding
Kalilinux#kali:~# hping3 -1 --flood -a 192.168.114.50 192.168.17.255

Maximum Concurrent Sesions
Setting di: Object | Security Profiles | DoS Protection
Create (Add) Object
Klik Tab : Resource Protection
Aktifkan (centang) Sessions, Kasih nilai 30.
Commit.

Lanjut Test Dengan Command Berikut:
Kalilinux#kali:~# hping3 -c 15000 -d 120 -S -w 64 -p 80 --flood --rand-source 192.168.114.50

46. Data Protection Profile
TCP SYN (Flood) Attack:
root@kali:~# hping3 -c 15000 -d 120 -S -w 64 -p 80 --flood --rand-source 192.168.17.150

root@kali:~# hping3 -c 15000 -d 120 -S -w 64 -p 443 --flood --rand-source 192.168.17.150
-------------------------------------------------------------------------------
ICMP Flooding Attack:
root@kali:~# hping3 -1 --flood -a  192.168.17.150 192.168.17.255
--------------------------------------------------------------------------------
UDP Port Scan:
root@kali:~# nmap -sU -p0-65535 192.168.17.150
root@kali:~# nmap -sU 192.168.17.150
--------------------------------------------------------------------------------
Host Sweep Attack:
root@kali:~# nmap -sP 192.168.17.150
-----------------------------------------------------------------------------
TCP Flood Attack:
root@kali:~# hping3 -S -P -U --flood -V --rand-source 192.168.17.150
------------------------------------------------------------------------
TCP Flood Attack DOS Protection Profile:
root@kali:~# hping3 -c 15000 -d 120 -S -w 64 -p 80 --flood --rand-source 192.168.17.150
-------------------------------------------------------------------
TCP Port SCAN
root@kali:~# nmap -p1-65535 -T4 -A -v 192.168.17.150
-------------------------------------------------------------
Host Sweep
root@kali:~# nmap -sP 192.168.17.0/24
-------------------------------------------------------------
palo alto

Anda mungkin menyukai postingan ini :

Posting Komentar untuk "PaloAlto | Firewall Security"

Posting Komentar