topic Re: Idenfiy number of connection of per zone with or without snmp in General Topics

Idenfiy number of connection of per zone with or without snmp

RamBalaji — Tue, 27 Feb 2018 13:51:55 GMT

Dear All,

I need to configure zone protection, how to find the number of connetion per second for each zone.

I tried with "show session info" and i can see "new connection establish rate" but i need to take the average for 2 or 3 weeks.

So if its on the snmp which ouid i have to use to monitor or any other method to identify the connection per second on each zone.

with regards,

Ram

Re: Idenfiy number of connection of per zone with or without snmp

BPry — Tue, 27 Feb 2018 14:09:18 GMT

@RamBalaji,

I don't really know of a good way to actually do this at all. What I usually recommend is that you set the 'Activate' and 'Maximum' values to something that you know you aren't going to hit; even if that's your platforms max session rate. Then you play around with the 'Alarm' rate until you essentially baseline the traffic.

Then make sure that your 'Action' for your Reconnaissance Protection is 'alert', and you can do the same here and play around with any source exclusions that you need to make.

Packet Based Attack Protection is something that you'll need to read up on and probably enable outside of business hours to ensure you don't cause any issues. All of these are detailed and you can make the determination on whether or not you want it on, but this is usually where people run into issues with legit traffic getting dropped when they first enable ZP.

Hope that helps a bit.

Re: Idenfiy number of connection of per zone with or without snmp

OtakarKlier — Tue, 27 Feb 2018 16:04:31 GMT

Hello,

The way I have done it in the past was take the default vaules. If after a month nothing got blocked, I would halve the values. Then keep this going until we saw an impact and then ramp it back up.

Cheers!

Re: Idenfiy number of connection of per zone with or without snmp

RamBalaji — Wed, 28 Feb 2018 05:30:27 GMT

Bpry & Otakar.Klier,

Thanks for sharing your experience. Environment is critical and needs to applied for 6 location, security team will not allow this approach.

Any other methods available ??

with regards,

Ram