06-24-2019 02:27 AM - edited 06-24-2019 02:57 AM
We are having attacks from outside to DMZ. Many diffrents ips are attacking our public range. These attacks are causing packet buffer 100% and CPU 100%, doing an outage in our network. So in traffic logs we can see all sesiones being denied for policy deny. Is there any way to avoid that FW proccess these sessions and not increasing CPU?? what actions can be taken in FW?
06-24-2019 06:46 AM - edited 06-24-2019 06:48 AM
Zone Protection profile and DoS Protection. Any details on the type of traffic?
06-24-2019 07:18 AM
Yes, i enabled but i think with the default paramethers is not helping a lot.
I attach a screenshot where you can see the sessions. Many sessions from differents ipsin the same second.The most of sessions are using the ports 744 and 736.
Any idea for not proccessing these sessions? to avoid impact in CPU
06-24-2019 08:18 AM
I cannot think of anything else to do but to shut down the interface until the attack is over. Let me know if you find an answer as it is an interesting topic. Sorry I cannot help more. If attack is not intended directly to you then it should not last too long. Good luck.
06-24-2019 08:31 AM
Which appliance do you have? What is the normal dp load on the firewall while it is not under attack?
You may want to not logging those policy-deny, because it is consuming CPU..
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!