topic Re: Trigger/logs DoS policy in General Topics

Trigger/logs DoS policy

BigPalo — Tue, 18 Sep 2018 08:18:21 GMT

Hello,

We would like to be notified when there is a high number of requests to our servers, and even to control them in time. Aside to be able to see an event in the logs (as it is the case with the flood in the sessions)

The configuration we are looking for does not require (and should not) limit the number of concurrent connections. We should only control the growth of connections over time. The idea is that, before an 'avalanche' of connections to a specific service, only 200 (for example) are allowed every 2 seconds, although after a few seconds / minutes, there are, for example, 2500 concurrent connections.

We have done tests (using j-meter), we observe that the DoS policy is executed, but we do not have logs or any trace or historical evidence, only We can see in real time, reviewing the status of the application of DoS policies.

Is that possible with PA doS policy??? how paramethers sould be configured???

Re: Trigger/logs DoS policy

BPry — Tue, 18 Sep 2018 16:53:41 GMT

@BigPalo,

I'm a bit confused on what you're actually looking for I guess. You can certiantly apply a maximum concurrent session limit, but you can't generically say that hosts can only create sessions at a set rate per second. That type of finer control would be set through the flood protection limits and is broken down into what you're actually looking at ( SYN UDP ICMP ect). When configuring flood protection you need to input an 'Activate' and 'Max' rate, but you can set this artifically high as to never have it trip for anyone.

As for alerting everything applied will be recorded in the Threat logs as subtype flood. What exactly triggered the policy will also be recorded ( Session Limit Event, TCP Flood, UDP Flood, ICMP Flood, ect) and you could then setup log forwarding so that you are alerted however you want when these alerts are triggered.

As for the parameters you should use, that's kind of on you to figure out. The values would be done based off of what you have recorded as the baseline. How I've configured a policy for example would have no baring or benefit if you were to apply the same policy on your own service; it's dependent on the environment that it's being deployed in.

Re: Trigger/logs DoS policy

BigPalo — Wed, 19 Sep 2018 07:56:34 GMT

We would like to be adviced about connections limit against server. This is the config:

If the same source machine launches more than 200 packets/sec, this machine will be blocked during 2 seconds.

We saw that the DoS policy is being applied but we dont see any event in threat logs. (sub type flood). Why is not showing anything in monitor->logs->threat.

We are simulating traffic with j-meter.