topic Re: Make exception in vulnerability in General Topics

Make exception in vulnerability

ZEBIT — Tue, 13 Dec 2016 20:12:12 GMT

For our website we host a database in our DMZ network. When we recieve a lot of calls from the website to the database the connection get a reset because the firewall see this as an attack (40031). Is there a way to configurate that the firewall allow more connections but that we are still save for attacks?

Re: Make exception in vulnerability

BPry — Tue, 13 Dec 2016 20:48:20 GMT

You could just make an exception for that server and then setup DoS protection for the server. It won't protect against HTTP unauthorized brute-force attempts per say, but usually when people launch an attack like this they would do it in a way that will trip a DoS profile.

Re: Make exception in vulnerability

ZEBIT — Wed, 14 Dec 2016 06:22:03 GMT

Hi BPry,

Thanks for the info. Can you give me some more information about how to setup the right settings?

Re: Make exception in vulnerability

fozail — Wed, 14 Dec 2016 07:37:19 GMT

Hi,

You can add an exception in the security profile on the basis of IP address and what it will do that it will not consider/identify this specific Threat for this source/destination.

Or, if you have specific security profile configured for this web server only, you can change the default action of this specific threat in the security profile, but make sure that it's not in use anywhere else at all, otherwise it will affect all.

DoS profile can be configured to provide protection against flood attack, it's an end host protection.

Best Regards,

Fozail

Re: Make exception in vulnerability

reaper — Wed, 14 Dec 2016 08:58:27 GMT

you can also tweak the number of hits required for the signature to trigger :

this way you can still leverage the added protection this signature offers on top of DoS protection

or simply add the server to the exceptions and still apply the signature to all other traffic

Re: Make exception in vulnerability

ZEBIT — Wed, 14 Dec 2016 09:22:39 GMT

All these answers helped me to configure a good policy.

Thanks all!