topic syn-cookie in General Topics

syn-cookie

sib2017 — Sun, 05 Jun 2016 12:43:15 GMT

Hi,

Where I can enable syn cookie .
SYN Cookie is activated when the SYN flood attack threshold is exceeded ?

Thanks

Re: syn-cookie

pankaku — Sun, 05 Jun 2016 13:54:02 GMT

Hi,

Sync cookie can be activated under dos protection, zone pprotection. You can either activacte syn-cookie or syn-flood.

Please check the following links:

https://live.paloaltonetworks.com/t5/Documentation-Articles/Threat-Prevention-Deployment-Tech-Note/ta-p/53157

https://live.paloaltonetworks.com/t5/Featured-Articles/Video-Tutorial-DoS-protection/ta-p/71164

https://live.paloaltonetworks.com/t5/Featured-Articles/Video-Tutorial-Zone-protection-profiles/ta-p/70687

Hope this helps!

Re: syn-cookie

sib2017 — Mon, 06 Jun 2016 08:41:07 GMT

Hi,

When the syn cookie will be activated?

Thanks

Re: syn-cookie

santonic — Mon, 06 Jun 2016 11:13:41 GMT

Number in 'Activate' field. 0 is quite good choice.

Re: syn-cookie

reaper — Mon, 06 Jun 2016 12:08:04 GMT

for syn cookies an activate of '0' is probably the best choice as syn cookies are an intelligent way of preventing 'bad' syn requests so can be used even at low activity

if 'random early drop' is chosen instead, the activate rate should be very high, close to where the amount of syn packets could become critical, as there is no reason to start discarding packets if there is very low activity