Flood protection

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Flood protection

L4 Transporter

What is the best way to set up flood protection, separate profile one for ICMP, one for SYN cookies etc or put it all in one policie? What is the best way to determine what set your alarm rates, block rate etc? How successful is it, does good traffice get blocked very much

15 REPLIES 15

L4 Transporter

I also see that there is zone protection and it looks very similar to flood protection, so which one is better?

I would go with Dos Protection profile and setup Dos Security Policy. As far as denying traffic it will depend on what "action " you choose when creating Dos proection policy there are 3 options Allow,Deny, Protect.

zone protection is the broad-stroke protection of an interface, regardless of the source-destination pair. it allows you to set up 'expected' flows and take action when your , for example, external interface comes under attack by enforcing syn cookies or dropping packets once a certain volume is reached

 

dos protection policies are there to protect specific resources. you can limit or regulate the flow towards a specific ip address

this comes in handy when for example your internet pipe throughput is much larger than one certain asset you want to protect, you can then finetine your protection to cater to specific servers while not limiting your overall throughput

 

 

hope this helps

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

I think that I want something more granular so I believe I will go with the DoS protection profile. I am currently in the process of deciding the best alarm rate, activate rate, max rate and block duration. I have some specific security policies using ICMP that I want to start with and then go from there.  I did a calculation based on my highest session numbers the result is very close to the limitation of 2,000,000 in the profile. So are you using this and how is it working for you?

 

11/13/2016 – 101.64M \7 days = 14.52M/day \86400 seconds in a day = 1.68M per sec

So the profile cannot just be added to a security policy, you have to create a DoS policy to put on the security policies

So you can't just apply a DoS profile to an existing security policies you have to create a DoS security policy, add a DoS protection profile and then add it to a security policies

no, the DoS protection policies are independent from security policies, much like the QoS policies

 

You first create a profile and then a (DoS) policy to match an expected flow.

 

 

 

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

So it affects everything? You can't just apply it to specific security policies?

Along the same lines, so I am going to fashion my DoS policy based on the security rule that I want to affect, I assume that will work

What log do the alarms go too? This is what profile I am going to start out with for icmp and icmpv6, I tried to base this on my current network highest session count

 

ICMP Flood and ICMVPv6 Flood
Alarm rate = 164 pps
Activate rate = 185.83 pps
Max rate = default (40000)
Block duration = default (300)

Can you set activate to 0 so it acts like an alert for testing the rule

the logs should appear in 'threat' log

 

if you set activate at 0, you will start blocking (or 'taking action' to put it better, for syn-cookies this is actually a preferred setting where random early drop would  be better suited with a much higher activate) immediately, setting the 'alert' to 0 will immediately start producing logs but not taking actions just yet.

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

So setting alert to 0 would be a good way to test if its working?

yes 🙂

 

 

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization
  • 4556 Views
  • 15 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!