topic Re: Zone protection profiles disadvantage or drawback in General Topics

Zone protection profiles disadvantage or drawback

MohammedAsikM — Fri, 17 Dec 2021 03:30:17 GMT

Hi All

Can anyone tell me the Zone protection profiles disadvantage or drawback

Re: Zone protection profiles disadvantage or drawback

OtakarKlier — Fri, 17 Dec 2021 20:22:43 GMT

Hello,

The only thing I can think of is if you change the default settings to be too sensitive. The other thing is if you set this and use the block-ip option, you could cause issues that way. However I always enable it with default settings and watch the threat logs to see what is happening. Then after a few weeks I might lower the default settings, but never more than half. Its actually in the STIG settings to have zone protection on all zones.

Regards,

Re: Zone protection profiles disadvantage or drawback

BPry — Fri, 17 Dec 2021 22:26:22 GMT

@MohammedAsikM,

As @OtakarKlier alluded to, there's a lot of advantages and it's something that should be enabled. There's just a few things that you need to think through while enabling it.

I highly recommend using the Alert thresholds to dial in your thresholds before lowing the activate and maximum values for flood protection. Things like the max-concurrent-limit for sessions will require you to do a bit of legwork before changing/enabling the limit, as there is no alert functionality for that. Reconnaissance protection can be dialed in with the alert action before you change the action values.