packet based attack

PanIst — Tue, 09 Dec 2014 21:05:06 GMT

Hi,

Will Choosing all options cause a false positive ?(especially IP option boxes)

And how can we see these drops ?

Thanks

Re: packet based attack

MSharma — Wed, 10 Dec 2014 00:26:44 GMT

Hello Panlst,

Enabling all options may drop legitimate traffic too.

To check drop packets , you can run following command :

> show zone-protection zone untrust

This output will show all the options that have been enabled and the number of packets dropped by it.

For best practices, please check following document too :

Please let us know if was helpful.

Thanks