topic Re: Prevent Scan in General Topics

Prevent Scan

soporteseguridad — Mon, 11 Nov 2013 13:35:25 GMT

HI,

we have detected that we are suffering a scan of all servers in our DMZ, the IP source is 151.236.14.140, on port 443.

How can we avoid this kind of attack or prevent it??

Thanks

Re: Prevent Scan

kadak — Mon, 11 Nov 2013 14:39:00 GMT

Hello soporteseguridad,

I would configure reconnaissance protection via zone protection profile to protect your to detect and block host sweep , TCP and UDP scans.

FYI, zone protection applies to incoming traffic. That means, if you want to protect DMZ then you should apply zone-protection on the Untrust zone (facing Internet) and the Trust zone (facing your LAN - if you wish to protect from inside threats as well ( for example an overtaken client is being used to DOS your DMZ devices))

Here are some documents which will help is configuring it:

Threat Prevention Deployment Tech Note (Page 41-42)

Understanding DoS Protection(Page 10-11)

Zone Protection Profile not Engaging During Penetration Scan

Hope that helps!

Thanks and regards,

Kunal Adak

Re: Prevent Scan

Phoenix — Mon, 11 Nov 2013 15:58:25 GMT

Hello soporteseguridad,

If we know the source IP then there is no problem we can directly create a security rule sourcing the IP and destined to Dmz servers for all apps and ports.

We can further use Scan prevention in Zone protection profile and apply it to the right zones.

We can customize the action and change the interval and so on. Once set we can see the logs by running the command as indicated in below doc.

How to Verify if Zone Protection is Working

Thanks