topic Flood protection in General Topics

Flood protection

jdprovine — Mon, 21 Nov 2016 16:01:52 GMT

What is the best way to set up flood protection, separate profile one for ICMP, one for SYN cookies etc or put it all in one policie? What is the best way to determine what set your alarm rates, block rate etc? How successful is it, does good traffice get blocked very much

Re: Flood protection

jdprovine — Mon, 21 Nov 2016 19:05:21 GMT

I also see that there is zone protection and it looks very similar to flood protection, so which one is better?

Re: Flood protection

clyde.franklin — Tue, 22 Nov 2016 00:09:33 GMT

I would go with Dos Protection profile and setup Dos Security Policy. As far as denying traffic it will depend on what "action " you choose when creating Dos proection policy there are 3 options Allow,Deny, Protect.

Re: Flood protection

reaper — Tue, 22 Nov 2016 08:21:40 GMT

zone protection is the broad-stroke protection of an interface, regardless of the source-destination pair. it allows you to set up 'expected' flows and take action when your , for example, external interface comes under attack by enforcing syn cookies or dropping packets once a certain volume is reached

dos protection policies are there to protect specific resources. you can limit or regulate the flow towards a specific ip address

this comes in handy when for example your internet pipe throughput is much larger than one certain asset you want to protect, you can then finetine your protection to cater to specific servers while not limiting your overall throughput

hope this helps

Re: Flood protection

jdprovine — Tue, 22 Nov 2016 14:08:44 GMT

I think that I want something more granular so I believe I will go with the DoS protection profile. I am currently in the process of deciding the best alarm rate, activate rate, max rate and block duration. I have some specific security policies using ICMP that I want to start with and then go from there. I did a calculation based on my highest session numbers the result is very close to the limitation of 2,000,000 in the profile. So are you using this and how is it working for you?

11/13/2016 – 101.64M \7 days = 14.52M/day \86400 seconds in a day = 1.68M per sec

Re: Flood protection

jdprovine — Tue, 22 Nov 2016 15:30:37 GMT

So the profile cannot just be added to a security policy, you have to create a DoS policy to put on the security policies

Re: Flood protection

jdprovine — Tue, 22 Nov 2016 15:32:45 GMT

So you can't just apply a DoS profile to an existing security policies you have to create a DoS security policy, add a DoS protection profile and then add it to a security policies

Re: Flood protection

reaper — Tue, 22 Nov 2016 15:41:47 GMT

no, the DoS protection policies are independent from security policies, much like the QoS policies

You first create a profile and then a (DoS) policy to match an expected flow.

Re: Flood protection

jdprovine — Tue, 22 Nov 2016 15:51:00 GMT

So it affects everything? You can't just apply it to specific security policies?

Re: Flood protection

jdprovine — Tue, 22 Nov 2016 17:18:40 GMT

Along the same lines, so I am going to fashion my DoS policy based on the security rule that I want to affect, I assume that will work

Re: Flood protection

jdprovine — Tue, 22 Nov 2016 17:34:55 GMT

What log do the alarms go too? This is what profile I am going to start out with for icmp and icmpv6, I tried to base this on my current network highest session count

ICMP Flood and ICMVPv6 Flood
Alarm rate = 164 pps
Activate rate = 185.83 pps
Max rate = default (40000)
Block duration = default (300)

Re: Flood protection

jdprovine — Tue, 22 Nov 2016 19:29:00 GMT

Can you set activate to 0 so it acts like an alert for testing the rule

Re: Flood protection

reaper — Wed, 23 Nov 2016 08:24:18 GMT

the logs should appear in 'threat' log

if you set activate at 0, you will start blocking (or 'taking action' to put it better, for syn-cookies this is actually a preferred setting where random early drop would be better suited with a much higher activate) immediately, setting the 'alert' to 0 will immediately start producing logs but not taking actions just yet.

Re: Flood protection

jdprovine — Wed, 23 Nov 2016 14:29:50 GMT

So setting alert to 0 would be a good way to test if its working?

Re: Flood protection

reaper — Wed, 23 Nov 2016 14:33:49 GMT

yes 🙂

Re: Flood protection

Brandon_Wertz — Mon, 28 Nov 2016 00:55:30 GMT

this is a great thread. Loved reading it learning more about both of these features and their practicle implementation.