Flood protection

[jdprovine]

What is the best way to set up flood protection, separate profile one for ICMP, one for SYN cookies etc or put it all in one policie? What is the best way to determine what set your alarm rates, block rate etc? How successful is it, does good traffice get blocked very much

[jdprovine]

I also see that there is zone protection and it looks very similar to flood protection, so which one is better?

[clyde.franklin]

I would go with Dos Protection profile and setup Dos Security Policy. As far as denying traffic it will depend on what "action " you choose when creating Dos proection policy there are 3 options Allow,Deny, Protect.

[reaper]

zone protection is the broad-stroke protection of an interface, regardless of the source-destination pair. it allows you to set up 'expected' flows and take action when your , for example, external interface comes under attack by enforcing syn cookies or dropping packets once a certain volume is reached

dos protection policies are there to protect specific resources. you can limit or regulate the flow towards a specific ip address

this comes in handy when for example your internet pipe throughput is much larger than one certain asset you want to protect, you can then finetine your protection to cater to specific servers while not limiting your overall throughput

hope this helps

[jdprovine]

I think that I want something more granular so I believe I will go with the DoS protection profile. I am currently in the process of deciding the best alarm rate, activate rate, max rate and block duration. I have some specific security policies using ICMP that I want to start with and then go from there.  I did a calculation based on my highest session numbers the result is very close to the limitation of 2,000,000 in the profile. So are you using this and how is it working for you?

11/13/2016 – 101.64M \7 days = 14.52M/day \86400 seconds in a day = 1.68M per sec

[jdprovine]

So the profile cannot just be added to a security policy, you have to create a DoS policy to put on the security policies

[jdprovine]

So you can't just apply a DoS profile to an existing security policies you have to create a DoS security policy, add a DoS protection profile and then add it to a security policies

[reaper]

no, the DoS protection policies are independent from security policies, much like the QoS policies

You first create a profile and then a (DoS) policy to match an expected flow.

[jdprovine]

So it affects everything? You can't just apply it to specific security policies?

[jdprovine]

Along the same lines, so I am going to fashion my DoS policy based on the security rule that I want to affect, I assume that will work

[jdprovine]

What log do the alarms go too? This is what profile I am going to start out with for icmp and icmpv6, I tried to base this on my current network highest session count

ICMP Flood and ICMVPv6 Flood
Alarm rate = 164 pps
Activate rate = 185.83 pps
Max rate = default (40000)
Block duration = default (300)

[jdprovine]

Can you set activate to 0 so it acts like an alert for testing the rule

[reaper]

the logs should appear in 'threat' log

if you set activate at 0, you will start blocking (or 'taking action' to put it better, for syn-cookies this is actually a preferred setting where random early drop would  be better suited with a much higher activate) immediately, setting the 'alert' to 0 will immediately start producing logs but not taking actions just yet.

[jdprovine]

So setting alert to 0 would be a good way to test if its working?

[reaper]

yes 🙂