What is the best way to set up flood protection, separate profile one for ICMP, one for SYN cookies etc or put it all in one policie? What is the best way to determine what set your alarm rates, block rate etc? How successful is it, does good traffice get blocked very much
I would go with Dos Protection profile and setup Dos Security Policy. As far as denying traffic it will depend on what "action " you choose when creating Dos proection policy there are 3 options Allow,Deny, Protect.
zone protection is the broad-stroke protection of an interface, regardless of the source-destination pair. it allows you to set up 'expected' flows and take action when your , for example, external interface comes under attack by enforcing syn cookies or dropping packets once a certain volume is reached
dos protection policies are there to protect specific resources. you can limit or regulate the flow towards a specific ip address
this comes in handy when for example your internet pipe throughput is much larger than one certain asset you want to protect, you can then finetine your protection to cater to specific servers while not limiting your overall throughput
hope this helps
I think that I want something more granular so I believe I will go with the DoS protection profile. I am currently in the process of deciding the best alarm rate, activate rate, max rate and block duration. I have some specific security policies using ICMP that I want to start with and then go from there. I did a calculation based on my highest session numbers the result is very close to the limitation of 2,000,000 in the profile. So are you using this and how is it working for you?
11/13/2016 – 101.64M \7 days = 14.52M/day \86400 seconds in a day = 1.68M per sec
So you can't just apply a DoS profile to an existing security policies you have to create a DoS security policy, add a DoS protection profile and then add it to a security policies
no, the DoS protection policies are independent from security policies, much like the QoS policies
You first create a profile and then a (DoS) policy to match an expected flow.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!