Make exception in vulnerability

[ZEBIT]

For our website we host a database in our DMZ network. When we recieve a lot of calls from the website to the database the connection get a reset because the firewall see this as an attack (40031). Is there a way to configurate that the firewall allow more connections but that we are still save for attacks?

[BPry]

You could just make an exception for that server and then setup DoS protection for the server. It won't protect against HTTP unauthorized brute-force attempts per say, but usually when people launch an attack like this they would do it in a way that will trip a DoS profile. 

[ZEBIT]

Hi BPry,

Thanks for the info. Can you give me some more information about how to setup the right settings?

[fozail]

Hi,

You can add an exception in the security profile on the basis of IP address and what it will do that it will not consider/identify this specific Threat for this source/destination.

Or, if you have specific security profile configured for this web server only, you can change the default action of this specific threat in the security profile, but make sure that it's not in use anywhere else at all, otherwise it will affect all.

DoS profile can be configured to provide protection against flood attack, it's an end host protection.

Best Regards,

Fozail

[reaper]

you can also tweak the number of hits required for the signature to trigger :

this way you can still leverage the added protection this signature offers on top of DoS protection

or simply add the server to the exceptions and still apply the signature to all other traffic

[ZEBIT]

All these answers helped me to configure a good policy.

Thanks all!