syn-cookie

[sib2017]

Hi,

Where I can enable syn cookie .
SYN Cookie is activated when the SYN flood attack threshold is exceeded ?

Thanks

[pankaku · Accepted solution]

Hi,

Sync cookie can be activated under dos protection, zone pprotection. You can either activacte syn-cookie or syn-flood.

Please check the following links:

https://live.paloaltonetworks.com/t5/Documentation-Articles/Threat-Prevention-Deployment-Tech-Note/t...

https://live.paloaltonetworks.com/t5/Featured-Articles/Video-Tutorial-DoS-protection/ta-p/71164

https://live.paloaltonetworks.com/t5/Featured-Articles/Video-Tutorial-Zone-protection-profiles/ta-p/...

Hope this helps!

[reaper · Accepted solution]

for syn cookies an activate of '0' is probably the best choice as syn cookies are an intelligent way of preventing 'bad' syn requests so can be used even at low activity

if 'random early drop' is chosen instead, the activate rate should be very high, close to where the amount of syn packets could become critical, as there is no reason to start discarding packets if there is very low activity

[pankaku · Accepted solution]

Hi,

Sync cookie can be activated under dos protection, zone pprotection. You can either activacte syn-cookie or syn-flood.

Please check the following links:

https://live.paloaltonetworks.com/t5/Documentation-Articles/Threat-Prevention-Deployment-Tech-Note/t...

https://live.paloaltonetworks.com/t5/Featured-Articles/Video-Tutorial-DoS-protection/ta-p/71164

https://live.paloaltonetworks.com/t5/Featured-Articles/Video-Tutorial-Zone-protection-profiles/ta-p/...

Hope this helps!

[sib2017]

Hi,

When the syn cookie will be activated?

Thanks

[santonic]

Number in 'Activate' field. 0 is quite good choice.

[reaper · Accepted solution]

for syn cookies an activate of '0' is probably the best choice as syn cookies are an intelligent way of preventing 'bad' syn requests so can be used even at low activity

if 'random early drop' is chosen instead, the activate rate should be very high, close to where the amount of syn packets could become critical, as there is no reason to start discarding packets if there is very low activity