topic Re: Aggregate vs Zone protection profiles in General Topics

Aggregate vs Zone protection profiles

raji_toor — Mon, 09 Nov 2020 16:55:33 GMT

We have separate zone protection profiles for each zone. And the definition of aggregate says that "all thresholds apply to the entire group of devices specified in a DoS Protection policy rule". So if we are trying to protect servers in DMZ, unless we use smaller groups (for which our environment doesn't seem to have a usecase). Do we even need to use Aggregate DOS protection. Only using Classified seems more appropriate in this scenario,

Also as i understand, I should be able club multiple DMZ servers in same DOS policy and the thresholds will apply to each server individually.

Re: Aggregate vs Zone protection profiles

BPry — Tue, 10 Nov 2020 02:45:29 GMT

@raji_toor,

Also as i understand, I should be able club multiple DMZ servers in same DOS policy and the thresholds will apply to each server individually.

If you have everything setup under just classified profile then yes that's correct.

So not knowing anything about your environment I can't tell you if you should use aggregate, but I can tell you that in the vast majority of environments you wouldn't throw all of your public services in the same DoS entry. If you're properly tuning your DoS profiles you shouldn't have the exact same values for your x website as you would have for y website or your Exchange server for instance. It's pretty rare I come across an environment where grouping them all under a sole entry is advisable.

Re: Aggregate vs Zone protection profiles

raji_toor — Tue, 10 Nov 2020 18:41:15 GMT

@BPry I understand it can be different for classified depending server/application itself, but am I right in my understanding of aggregate vs zone protection profiles.

Re: Aggregate vs Zone protection profiles

BPry — Tue, 10 Nov 2020 18:56:55 GMT

@raji_toor,

So your understanding is that you shouldn't set an aggregate profile because you already have Zone Protection configured on the zone right? The zone protection can accomplish the same thing as an aggregate profile, but you would generally have your Zone Protection values set much higher than you ever would on a DoS profile. If you're just going to set those values high enough that your ZP would trip anyways then yes you wouldn't setup an aggregate profile.