dns amplification attack

[sib2017]

Hi,

What are the best practices need to be followed  to  protect from the ddos  dns amplification attack . 

How to  filter the  trace  from the  log  if there is any attack happened ? 

Thanks

[santonic]

Zone protection on outside/external/internet interface to protect your servers. And zone protection on the interface where your DNS servers are to prevent your servers being used as amplifiers. 

[rmonvon · Accepted solution]

Here's a Tech Note which covers threat & DoD Protection.  Check it out:  https://live.paloaltonetworks.com/t5/Documentation-Articles/Threat-Prevention-Deployment-Tech-Note/t...

[sib2017]

Hi,

"And zone protection on the interface where your DNS servers are to prevent your servers being used as amplifiers. "

Can you explain how to do that .

Thank you 

[santonic · Accepted solution]

Zone protection profile on outside/internet interface will protect your servers from traffic originating from internet.

Zone protection profile on interface where your DNS servers are will prevent your servers sending a lot of traffic towards internet (or some other zone) if they get compromised somehow.