Create a zone protection profile

POST 
/zone-protection-profiles

Create a new zone protection profile.

Request

application/json

Body

Created

oneOf

folder

folder stringrequired

Possible values: <= 64 characters, Value must match regular expression ^[a-zA-Z\d-_\. ]+$

The folder in which the resource is defined

snippet

snippet stringrequired

Possible values: <= 64 characters, Value must match regular expression ^[a-zA-Z\d-_\. ]+$

The snippet in which the resource is defined

device

device stringrequired

Possible values: <= 64 characters, Value must match regular expression ^[a-zA-Z\d-_\. ]+$

The device in which the resource is defined

name stringrequired

Possible values: <= 31 characters

The profile name

description string

Possible values: <= 255 characters

The description of the profile

flood object

tcp_syn object

oneOf

red

alarm_rate int32required

Possible values: <= 2000000

When the flow exceeds the `alert_rate`` threshold, an alarm is generated.

activate_rate int32required

Possible values: <= 2000000

When the flow exceeds the `activate_rate`` threshold, the firewall drops individual SYN packets randomly to restrict the flow.

maximal_rate int32required

Possible values: <= 2000000

When the flow exceeds the maximal_rate threshold, 100% of incoming SYN packets are dropped.

syn_cookies

alarm_rate int32required

Possible values: <= 2000000

When the flow exceeds the `alert_rate`` threshold, an alarm is generated.

activate_rate int32required

Possible values: <= 2000000

When the flow exceeds the `activate_rate`` threshold, the firewall drops individual SYN packets randomly to restrict the flow.

maximal_rate int32required

Possible values: <= 2000000

When the flow exceeds the maximal_rate threshold, 100% of incoming SYN packets are dropped.

udp object

enable boolean

Enable protection against UDP floods?

red object

alarm_rate int32required

Possible values: <= 2000000

The number of UDP packets (not matching an existing session) that the zone receives per second that triggers an attack alarm.

activate_rate int32required

Possible values: <= 2000000

The number of UDP packets (not matching an existing session) that the zone receives per second that triggers random dropping of UDP packets.

maximal_rate int32required

Possible values: <= 2000000

The maximum number of UDP packets (not matching an existing session) the zone receives per second before packets exceeding the maximum are dropped.

sctp_init object

enable boolean

Enable protection against floods of Stream Control Transmission Protocol (SCTP) packets that contain an Initiation (INIT) chunk?

red object

alarm_rate int32required

Possible values: <= 2000000

The number of SCTP INIT packets (not matching an existing session) that the zone receives per second that triggers an attack alarm.

activate_rate int32required

Possible values: <= 2000000

The number of SCTP INIT packets (not matching an existing session) that the zone receives per second before subsequent SCTP INIT packets are dropped.

maximal_rate int32required

Possible values: <= 2000000

The maximum number of SCTP INIT packets (not matching an existing session) that the zone receives per second before packets exceeding the maximum are dropped.

icmp object

enable boolean

Enable protection against ICMP floods?

red object

alarm_rate int32required

Possible values: <= 2000000

The number of ICMP echo requests (pings not matching an existing session) that the zone receives per second that triggers an attack alarm.

activate_rate int32required

Possible values: <= 2000000

The number of ICMP packets (not matching an existing session) that the zone receives per second before subsequent ICMP packets are dropped.

maximal_rate int32required

Possible values: <= 2000000

The maximum number of ICMP packets (not matching an existing session) that the zone receives per second before packets exceeding the maximum are dropped.

icmpv6 object

enable boolean

Enable protection against ICMPv6 floods?

red object

alarm_rate int32required

Possible values: <= 2000000

The number of ICMPv6 echo requests (pings not matching an existing session) that the zone receives per second that triggers an attack alarm.

activate_rate int32required

Possible values: <= 2000000

The number of ICMPv6 packets (not matching an existing session) that the zone receives per second before subsequent ICMPv6 packets are dropped.

maximal_rate int32required

Possible values: <= 2000000

The maximum number of ICMPv6 packets (not matching an existing session) that the zone receives per second before packets exceeding the maximum are dropped.

other_ip object

enable boolean

Enable protection against other IP (non-TCP, non-ICMP, non-ICMPv6, non-SCTP, and non-UDP) floods?

red object

alarm_rate int32required

Possible values: <= 2000000

activate_rate int32required

Possible values: <= 2000000

maximal_rate int32required

Possible values: <= 2000000

scan object[]
Array [
name stringrequired
Possible values: [8001, 8002, 8003, 8006]
The threat ID number. These can be found in Palo Alto Networks ThreatVault.
• "8001" - TCP Port Scan
• "8002" - Host Sweep
• "8003" - UDP Port Scan
• "8006" - Port Scan
action object
oneOf
allow
object
alert
object
block
object
block_ip
track_by stringrequired
Possible values: [source-and-destination, source]
duration int32required
Possible values: >= 1 and <= 3600
interval int32
Possible values: >= 2 and <= 65535
threshold int32
Possible values: >= 2 and <= 65535
]
scan_white_list object[]
Array [
name stringrequired
A descriptive name for the address to exclude.
]
spoofed_ip_discard boolean

Check that the source IP address of the ingress packet is routable and the routing interface is in the same zone as the ingress interface. If either condition is not true, discard the packet.

strict_ip_check boolean
Check that both conditions are true:
• The source IP address is not the subnet broadcast IP address of the ingress interface.
• The source IP address is routable over the exact ingress interface. If either condition is not true, discard the packet.
fragmented_traffic_discard boolean

Discard fragmented IP packets.

strict_source_routing_discard boolean

Discard packets with the Strict Source Routing IP option set. Strict Source Routing is an option whereby a source of a datagram provides routing information through which a gateway or host must send the datagram.

loose_source_routing_discard boolean

Discard packets with the Loose Source Routing IP option set. Loose Source Routing is an option whereby a source of a datagram provides routing information and a gateway or host is allowed to choose any route of a number of intermediate gateways to get the datagram to the next address in the route.

timestamp_discard boolean

Discard packets with the Timestamp IP option set.

record_route_discard boolean

Discard packets with the Record Route IP option set. When a datagram has this option, each router that routes the datagram adds its own IP address to the header, thus providing the path to the recipient.

security_discard boolean

Discard packets if the security option is defined.

stream_id_discard boolean

Discard packets if the Stream ID option is defined.

unknown_option_discard boolean

Discard packets if the class and number are unknown.

malformed_option_discard boolean

Discard packets if they have incorrect combinations of class, number, and length based on RFCs 791, 1108, 1393, and 2113.

mismatched_overlapping_tcp_segment_discard boolean

Drop packets with mismatched overlapping TCP segments.

tcp_handshake_discard boolean

Drop packets with split handshakes.

tcp_syn_with_data_discard boolean

Default value: true

Prevent a TCP session from being established if the TCP SYN packet contains data during a three-way handshake.

tcp_synack_with_data_discard boolean

Default value: true

Prevent a TCP session from being established if the TCP SYN-ACK packet contains data during a three-way handshake.

reject_non_syn_tcp string
Possible values: [global, yes, no]
Determine whether to reject the packet if the first packet for the TCP session setup is not a SYN packet:
• global — Use system-wide setting that is assigned through the CLI.
• yes — Reject non-SYN TCP.
• no — Accept non-SYN TCP.
asymmetric_path string
Possible values: [global, drop, bypass]
Determine whether to drop or bypass packets that contain out-of-sync ACKs or out-of-window sequence numbers:
• global — Use system-wide setting that is assigned through TCP Settings or the CLI.
• drop — Drop packets that contain an asymmetric path.
• bypass — Bypass scanning on packets that contain an asymmetric path.
tcp_timestamp_strip boolean

Determine whether the packet has a TCP timestamp in the header and, if it does, strip the timestamp from the header.

tcp_fast_open_and_data_strip boolean

Strip the TCP Fast Open option (and data payload, if any) from the TCP SYN or SYN-ACK packet during a TCP three-way handshake.

mptcp_option_strip string
Possible values: [no, yes, global]
Default value: global
MPTCP is an extension of TCP that allows a client to maintain a connection by simultaneously using multiple paths to connect to the destination host. By default, MPTCP support is disabled, based on the global MPTCP setting. Review or adjust the MPTCP settings for the security zones associated with this profile:
• no — Enable MPTCP support (do not strip the MPTCP option).
• yes — Disable MPTCP support (strip the MPTCP option). With this configured, MPTCP connections are converted to standard TCP connections, as MPTCP is backwards compatible with TCP.
• global — Support MPTCP based on the global MPTCP setting. By default, the global MPTCP setting is set to yes so that MPTCP is disabled (the MPTCP option is stripped from the packet).
icmp_ping_zero_id_discard boolean

Discard packets if the ICMP ping packet has an identifier value of 0.

icmp_frag_discard boolean

Discard packets that consist of ICMP fragments.

icmp_large_packet_discard boolean

Discard ICMP packets that are larger than 1024 bytes.

discard_icmp_embedded_error boolean

Discard ICMP packets that are embedded with an error message.

suppress_icmp_timeexceeded boolean

Stop sending ICMP TTL expired messages.

suppress_icmp_needfrag boolean

Stop sending ICMP fragmentation needed messages in response to packets that exceed the interface MTU and have the do not fragment (DF) bit set. This setting will interfere with the PMTUD process performed by hosts behind the firewall.

ipv6 object

routing_header_0 boolean

Drop packets with type 0 routing header.

routing_header_1 boolean

Drop packets with type 1 routing header.

routing_header_3 boolean

Drop packets with type 3 routing header.

routing_header_4_252 boolean

Drop packets with type 4 to type 252 routing header.

routing_header_253 boolean

Drop packets with type 253 routing header.

routing_header_254 boolean

Drop packets with type 254 routing header.

routing_header_255 boolean

Drop packets with type 255 routing header.

ipv4_compatible_address boolean

Discard IPv6 packets that are defined as an RFC 4291 IPv4-Compatible IPv6 address.

filter_ext_hdr object

hop_by_hop_hdr boolean

Discard IPv6 packets that contain the Hop-by-Hop Options extension header.

routing_hdr boolean

Discard IPv6 packets that contain the Routing extension header, which directs packets to one or more intermediate nodes on its way to its destination.

dest_option_hdr boolean

Discard IPv6 packets that contain the Destination Options extension, which contains options intended only for the destination of the packet.

options_invalid_ipv6_discard boolean

Discard IPv6 packets that contain invalid IPv6 options in an extension header.

reserved_field_set_discard boolean

Discard IPv6 packets that have a header with a reserved field not set to zero.

anycast_source boolean

Discard IPv6 packets that contain an anycast source address.

needless_fragment_hdr boolean

Discard IPv6 packets with the last fragment flag (M=0) and offset of zero.

icmpv6_too_big_small_mtu_discard boolean

Discard IPv6 packets that contain a Packet Too Big ICMPv6 message when the maximum transmission unit (MTU) is less than 1,280 bytes.

ignore_inv_pkt object

dest_unreach boolean

Require an explicit Security policy match for Destination Unreachable ICMPv6 messages, even when the message is associated with an existing session.

pkt_too_big boolean

Require an explicit Security policy match for Packet Too Big ICMPv6 messages, even when the message is associated with an existing session.

time_exceeded boolean

Require an explicit Security policy match for Time Exceeded ICMPv6 messages, even when the message is associated with an existing session.

param_problem boolean

Require an explicit Security policy match for Parameter Problem ICMPv6 messages, even when the message is associated with an existing session.

redirect boolean

Require an explicit Security policy match for Redirect Message ICMPv6 messages, even when the message is associated with an existing session.

non_ip_protocol object
list_type string
Possible values: [exclude, include]
Specify the type of list you are creating for protocol protection:
• Include List—Only the protocols on the list are allowed—in addition to IPv4 (0x0800), IPv6 (0x86DD), ARP (0x0806), and VLAN tagged frames (0x8100). All other protocols are implicitly denied (blocked).
• Exclude List—Only the protocols on the list are denied; all other protocols are implicitly allowed. You cannot exclude IPv4 (0x0800), IPv6 (0x86DD), ARP (0x0806), or VLAN tagged frames (0x8100).
protocol object[]
Array [
name stringrequired
Enter the protocol name that corresponds to the Ethertype code you are adding to the list. The firewall does not verify that the protocol name matches the Ethertype code but the Ethertype code does determine the protocol filter.
ether_type stringrequired
Enter an Ethertype code (protocol) preceded by 0x to indicate hexadecimal (range is 0x0000 to 0xFFFF). A list can have a maximum of 64 Ethertypes. Some sources of Ethertype codes are:
• IEEE hexadecimal Ethertype
• standards.ieee.org/develop/regauth/ethertype/eth.txt
• http://www.cavebear.com/archive/cavebear/Ethernet/type.html
enable boolean
Enable the Ethertype code on the list.
]
l2_sec_group_tag_protection object
tags object[]
Array [
name stringrequired
Name for the list of Security Group Tags (SGTs).
tag stringrequired
The Layer 2 SGTs in headers of packets that you want to exclude (drop) when the SGT matches this list in the Zone Protection profile applied to a zone (range is 0 to 65,535).
enable boolean
Enable this exclude list for Ethernet SGT protection.
]

Responses

201

Created

400

Bad Request

application/json

Schema

Schema

_errors object[]
Array [
code string
message string
details object
help string
]
_request_id string

Example (from schema)

{
  "_errors": [
    {
      "code": "string",
      "message": "string",
      "details": {},
      "help": "string"
    }
  ],
  "_request_id": "string"
}

input_format_mismatch

Input Format Mismatch

{
  "_errors": [
    {
      "code": "E003",
      "message": "Input Format Mismatch: input-format=json",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

output_format_mismatch

Output Format Mismatch

{
  "_errors": [
    {
      "code": "E003",
      "message": "Output Format Mismatch: output-format=json Accept=xml",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

missing_query_parameter

Missing Query Parameter

{
  "_errors": [
    {
      "code": "E003",
      "message": "Missing Query Parameter: name",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

invalid_query_parameter

Invalid Query Parameter

{
  "_errors": [
    {
      "code": "E003",
      "message": "Invalid Query Parameter: location=invalid",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

missing_body

Missing Body

{
  "_errors": [
    {
      "code": "E003",
      "message": "Missing Body",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

invalid_object

Invalid Object

{
  "_errors": [
    {
      "code": "E003",
      "message": "Invalid Object",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

401

Unauthorized

application/json

Schema

Schema

_errors object[]
Array [
code string
message string
details object
help string
]
_request_id string

Example (from schema)

{
  "_errors": [
    {
      "code": "string",
      "message": "string",
      "details": {},
      "help": "string"
    }
  ],
  "_request_id": "string"
}

auth_not_authenticated

Not Authenticated

{
  "_errors": [
    {
      "code": "E016",
      "message": "Not Authenticated",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

invalid_credential

Invalid Credential

{
  "_errors": [
    {
      "code": "E016",
      "message": "Invalid Credential",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

key_too_long

Key Too Long

{
  "_errors": [
    {
      "code": "E016",
      "message": "Key Too Long",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

key_expired

Key Expired

{
  "_errors": [
    {
      "code": "E016",
      "message": "Key Expired",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

need_password_change

Need Password Change

{
  "_errors": [
    {
      "code": "E016",
      "message": "The password needs to be changed.",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

403

Forbidden

application/json

Schema

Schema

_errors object[]
Array [
code string
message string
details object
help string
]
_request_id string

Example (from schema)

{
  "_errors": [
    {
      "code": "string",
      "message": "string",
      "details": {},
      "help": "string"
    }
  ],
  "_request_id": "string"
}

auth_unauthorized

Unauthorized

{
  "_errors": [
    {
      "code": "E007",
      "message": "Unauthorized",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

409

Conflict

application/json

Schema

Schema

_errors object[]
Array [
code string
message string
details object
help string
]
_request_id string

Example (from schema)

{
  "_errors": [
    {
      "code": "string",
      "message": "string",
      "details": {},
      "help": "string"
    }
  ],
  "_request_id": "string"
}

object_not_unique

Object Not Unique

{
  "_errors": [
    {
      "code": "E016",
      "message": "Object Not Unique",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

name_not_unique

Name Not Unique

{
  "_errors": [
    {
      "code": "E006",
      "message": "Name Not Unique",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

reference_not_zero

Reference Not Zero

{
  "_errors": [
    {
      "code": "E009",
      "message": "Reference Not Zero",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

default

General Errors

application/json

Schema

Schema

_errors object[]
Array [
code string
message string
details object
help string
]
_request_id string

Example (from schema)

{
  "_errors": [
    {
      "code": "string",
      "message": "string",
      "details": {},
      "help": "string"
    }
  ],
  "_request_id": "string"
}

version_not_supported

Version Not Supported

{
  "_errors": [
    {
      "code": "E012",
      "message": "Version Not Supported",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

method_not_allowed

Method Not Supported

{
  "_errors": [
    {
      "code": "E012",
      "message": "Method Not Supported",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

action_not_supported

Action Not Supported

{
  "_errors": [
    {
      "code": "E012",
      "message": "Action Not Supported: move",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

bad_xpath

Bad XPath

{
  "_errors": [
    {
      "code": "E013",
      "message": "Bad XPath",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

invalid_command

Invalid Command

{
  "_errors": [
    {
      "code": "E003",
      "message": "Invalid Command",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

malformed_command

Malformed Command

{
  "_errors": [
    {
      "code": "E003",
      "message": "Malformed Command",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

session_timeout

Session Timeout

{
  "_errors": [
    {
      "code": "4",
      "message": "Session Timeout",
      "details": {}
    }
  ],
  "_request_id": "123e4567-e89b-12d3-a456-426655440000"
}

Loading...