topic Re: About DNS amplification attack issue in General Topics

About DNS amplification attack issue

vincentsun — Thu, 12 Jun 2014 09:11:07 GMT

Dear Sir,

We have a customer for education envirument and they suffered a lot of DNS amplification attacks.Last 7 days session count is 688 Million and 220G Bytes for DNS traffic.

We try to drop the "Threat ID 36027 DNS Amplication Attack Query " and "Threat ID 36029 DNS Amplication Attack Response",But we only drop the ID 36027 signature once.

We want to know the problem for IPS signature Issue? Hope you can help us, Thanks!

Vincent.

Re: About DNS amplification attack issue

HULK — Thu, 12 Jun 2014 15:45:46 GMT

Hello Vincent,

Could you please let us know, what content database version is installed on your PAN firewall. The default action of above mentioned threats is "alert".

Could you please set the action to "drop-all-packet" or "reset-both". So that, all packets matching with the signature of above mentioned Threat ID will be dropped by PAN.

Thanks

Re: About DNS amplification attack issue

vincentsun — Mon, 16 Jun 2014 09:30:01 GMT

Hi HULK,

We already drop the "DNS Amplication Attack" . Thanks!

Vincent.