About DNS amplification attack issue

[vincentsun]

Dear Sir,

We have a customer for education envirument and they suffered a lot of DNS amplification attacks.Last 7 days session count is 688 Million and 220G Bytes for DNS traffic.

We try to drop the "Threat ID 36027 DNS Amplication Attack Query " and "Threat ID 36029 DNS Amplication Attack Response",But we only drop the ID 36027 signature once.

We want to know the problem for IPS signature Issue? Hope you can help us, Thanks!

Vincent.

[HULK]

Hello Vincent,

Could you please let us know, what content database version is installed on your PAN firewall. The default action of above mentioned threats is "alert".

Could you please set the action to "drop-all-packet" or "reset-both". So that, all packets matching with the signature of above mentioned Threat ID will be dropped by PAN.

Thanks

[vincentsun]

Hi HULK,

We already drop the "DNS Amplication Attack" . Thanks!

Vincent.