scan-host sweep

[sib2017]

Hi,

Under threat detection, scan host sweep  droped some traffic. And under the rules it did not show anything .

What does it mean

Thanks

[fozail]

Hi,

Do you have a zone protection profile configured and you have configured an action for the host sweep scan?

Best Regards,

Fozail

[reaper]

You probably have zone protection enabled

'host sweep' is a reconnaissance attack where a host 'scans' several of your ip addresses

[sib2017]

Hi,

what is the interval and Threshold here .

how a zone protection profile integrated with a zone ?

for example if we have zone trust,server , how we assign the profile to the zone .

What if we change  from the block to alert ? .

Thanks

[reaper]

Threshold is the number of events in the interval amount of time
So 100 hosts touched in 2 seconds for example
Zone protection is global for all traffic hitting a destination zone

If you need to be more granular, to protect a single server's resources for example, you should use a DOS policy

If you set action alert instead of block, you will simply see a log entry for each 'scan' but no action is taken

[fozail]

Hi Reaper,

As far as I remember "Zone Protection Profile" applies on source zone not on destination zone, correct me if I am wrong.

Best Regards,

Fozail

[kiwi]

Hi @fozail,

Zone protection profile is designed to provide broad-based protection at the ingress zone (i.e. the zone where traffic enters the firewall) and is not designed to protect a specific end host or traffic going to a particular destination zone.   Use the DoS protection rulebase to match on a specific zone, interface, IP address or user.

Cheers !

-Kim.

[fozail]

Hi Kim,

Yes, you are correct. I got confused as per other description where it is mentioned that "zone protection is for destination zone".

Thank you for the clarification.