NTP attacks - threshold-based blocks?

[aaronm]

Our campus has been getting a lot of NTP DDoS attacks of late.  While the simple solution would be to shut it down except for necessary systems, the problem (as per usual in public-sector) is that everyone seems to want to run something that uses it and complains if we start blocking.

Looking at the attacks, it's very easy to see the difference between a legitimate NTP query (1 or 2 packets) and an attack.   My question is: Is there a way to define a threshold-based filter that will drop or block the attack as with brute-force type attacks?  That would solve all of the issues.

[Phoenix]

Hello aaronm,

We can have a threshold based filter with respect to the sessions. In DOS protection profile we can set the Resource Protection to lets say 10 sessions, any traffic coming more than 10 sessions at a time is blocked and we can see the results in global counters.

This is purely used in scenarios where a specific traffic is bombarded. But if anything less than 10 sessions or 10 new packets it allows.

In the DOS rule we can configure the source and destination zone and source and destination IPs accordingly to narrow down right to the attacker.

Hope this helps.

[aaronm]

Hmm... that might work if I can create a firewall rule to limit such DoS protection to only the NTP traffic - applying that to the campus traffic as a whole would seriously break things.

[Phoenix]

In the DOS rule we have an option to specify the service. We can provide port 123 for NTP and that should help by not matching all other campus traffic and only NTP.

Thanks

[aaronm]

Yes - I was looking into it and that was the approach that I was going to try taking.  The catch is, we only want this applied on a per IP basis, not to all traffic using UDP 123, or again, with over 40K devices, that threshold would be overrun very quickly.

It would be better if PAN could define a new brute-force vulnerability for NTP so that it could be setup with a configurable threshold, and then an action be picked as a result.  Until that happens though (or if it happens at all) the DoS method may be the only thing I have to use against it.