topic Re: DDoS against their DNS servers and protection in General Topics

DDoS against their DNS servers and protection

MP18 — Sat, 20 Oct 2018 01:10:27 GMT

what is best way to protect the DNS servers against the resource exhaustion because of denial-of-service attacks ?

should we use zone protection

DDos protection?

Re: DDoS against their DNS servers and protection

reaper — Mon, 22 Oct 2018 12:32:03 GMT

hi @MP18

You'll want to use both

Zone protection protects an entire zone while DoS protection protects a resource (a single server or a farm).

Re: DDoS against their DNS servers and protection

Dali_Chauhan — Mon, 22 Oct 2018 12:45:01 GMT

Configure DDos protection profile as to secure perticular server or subnet. while zone protection provides protection based on the interface /zone and will be application for whole zone.

Re: DDoS against their DNS servers and protection

Dali_Chauhan — Mon, 22 Oct 2018 12:46:44 GMT

Kindly follow below link to configure the DoS Protection profle.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClL3CAK

Re: DDoS against their DNS servers and protection

Remo — Wed, 24 Oct 2018 10:41:40 GMT

@MP18

Be careful with the protection of UDP services, as these could be spoofed easily which could result in bringing your services partially "offline" when source IPs of big DNS players (like google, cloudflare, ...) are blocked by your zone/DoS protection.