Create a rule

[s_quasar]

Hi,

is there a way to create a rule like this?

if

( session_end_reason eq aged-out ) and ( zone.dst eq SERVER ) and ( app eq incomplete ) and ( rule eq MY OUTSIDE RULE ) and ( bytes eq 308 )

block the IP for 300 seconds

[reaper]

not like that, but you can enable zone protection with syn cookies and tweak reconnaissence / packet based attacks to prevent odd connections like this from ever reaching the policy

[s_quasar]

Hi,
Yes I agree with you but I have some problems with DoS Protection.
Can you read my post here https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Discussions/Tcp-flood/td-p/182561 and help me?

Thank you.

[reaper]

i'll reply to that article