topic Difference between Aggregate and Classified DoS Protection in General Topics

Difference between Aggregate and Classified DoS Protection

kalyanram.piratla — Mon, 13 Feb 2012 16:14:44 GMT

Hi Folks,

I tried a lot to get my head around Aggregate and Classified DoS Protection. For some reason, i haven't been able to understand the difference. Tried looking into the knowledge base, but nothing helped me. Could someone please explain in short what the difference is.

Thanks in advance.

Regards,

Re: Difference between Aggregate and Classified DoS Protection

mikand — Tue, 14 Feb 2012 07:35:38 GMT

My understanding from the administrator guide for PANOS 4.1 is that Aggregate is how often (based on a total count) you want the PAN unit to take action against the presumed attacker while Classified is how to group presumed attacks (page 149).

This is also further explained later in the manual (page 162).

For example:

You wish to block all traffic as soon as you hit 10.000 requests within 1 min: use Aggregate.

You wish to block all traffic as soon as you have >10 concurrent requests: use Classified.

A real world example would be to use Aggregate to block a portscan (since you define the time for which the counters should collect for) where Classified wont work if the portscanner test one port at a time.

But I agree, I hope PA will improve the documentation regarding this.

Re: Difference between Aggregate and Classified DoS Protection

kalyanram.piratla — Tue, 14 Feb 2012 09:22:59 GMT

Thanks mate for the answer. It was helpful.

Regards,

Re: Difference between Aggregate and Classified DoS Protection

RamBista1 — Sat, 04 Mar 2017 00:31:16 GMT

I also agree that the Palo Alto would improve the DoS document with some real world examples on this.

Re: Difference between Aggregate and Classified DoS Protection

gwesson — Sat, 04 Mar 2017 00:38:55 GMT

It's actually even more straightforward than that:

Classified = count of connections per second for a source IP.

Aggregate = count of connections per second for all source IPs combined.

There's a doc here that briefly covers it:

https://live.paloaltonetworks.com/t5/Learning-Articles/Differences-between-DoS-Protection-and-Zone-Protection/ta-p/57761

Another one that goes into more detail specifically about DoS:

https://live.paloaltonetworks.com/t5/Featured-Articles/How-to-Set-Up-DoS-Protection/ta-p/71164

Hope that helps!

Greg