topic Re: dns amplification attack in General Topics

dns amplification attack

sib2017 — Tue, 29 Mar 2016 07:51:08 GMT

Hi,

What are the best practices need to be followed to protect from the ddos dns amplification attack .

How to filter the trace from the log if there is any attack happened ?

Thanks

Re: dns amplification attack

santonic — Tue, 29 Mar 2016 13:33:25 GMT

Zone protection on outside/external/internet interface to protect your servers. And zone protection on the interface where your DNS servers are to prevent your servers being used as amplifiers.

Re: dns amplification attack

rmonvon — Tue, 29 Mar 2016 13:36:25 GMT

Here's a Tech Note which covers threat & DoD Protection. Check it out: https://live.paloaltonetworks.com/t5/Documentation-Articles/Threat-Prevention-Deployment-Tech-Note/ta-p/53157

Re: dns amplification attack

sib2017 — Sun, 03 Apr 2016 06:53:09 GMT

Hi,

"And zone protection on the interface where your DNS servers are to prevent your servers being used as amplifiers. "

Can you explain how to do that .

Thank you

Re: dns amplification attack

santonic — Mon, 04 Apr 2016 06:41:54 GMT

Zone protection profile on outside/internet interface will protect your servers from traffic originating from internet.

Zone protection profile on interface where your DNS servers are will prevent your servers sending a lot of traffic towards internet (or some other zone) if they get compromised somehow.