random-drop vs drop - zone protection

[raji_toor]

For TCP flood logs should only show "random-drop" with RED configured.

"drop" for TCP flood is this coming from options set under "TCP Drop" options under Packet Based Attack Protection. 

[SteveCantwell]

Good Day.

Flood Protection is typically only used for the TCP/UDP/IP/IPv6 protections under the first tab in the Zone Protection Profile.

It is recommended to do SynCookies vs RED for traffic from External zone.

Thank you.

[raji_toor]

@SteveCantwell  These are my flood protection settings. I should be seeing only random-drop in logs. What is causing the 'drop' logs?

[SteveCantwell]

That is a good question... I have my FW configured for Syn Cookies per PANW.  RED is typically only for UDP traffic, not TCP... so perhaps there is some internal logic at play here.  Best to swap it (correctly... ) to SYN Cookies.  This is per PANW recommendations.

Oh, I also think.. that proper 3 way TCP handshake will be random dropped, but if some src IP did not respond and sent a 2nd SYN packet, the FW will probably DROP that... that is what I think is happening...

Anything else I can assist with?

[raji_toor]

@SteveCantwell Thanks for your effort to answer this. I will probably ask support to have a good clarification.

And regarding your SYN-Cookie suggestion, I had it enabled recently but reverted back to RED when we found during an internal scan, that because firewall is replying SYN's on servers behalf it was also giving SYN replies when the servers did not even exist. We would not like to have that when we have /24 range facing internet.