TCP & UDP Floods from trusted zones

[Arman_Zaheri]

Hi everyone,

We receive TCP or UDP Flood threat logs from time to time on different firewalls of ours. In the image below you can see that the source and destination zones are the same, i.e. "zoneTrust", and this the case for all threat logs of this type. Is this information regarding zones reliable? and if yes, how can we find the host(s) responsible for these syn-floods?

BR,

[reaper · Accepted solution]

The source zone is the actual source, as that is the zone protection profile that is being hit. The destination zone may be incorrect as the firewall is discarding a flood packet (skipping destination route lookup etc)

This is a RED (random early drop) action. If this is unexpected, this may mean you have your 'activate' set too low

RED will progressively start discarding random packets once it reaches the activate rate (and progressively more the closer the rate gets to the maximum)

if you're using the default settings you'll have 10.000 alarm, 10.000 activate and 40.000 max, see about increasing the activate to a level that is slightly above the expected peak (connections per second during peak time)

e.g. if your normal cps is 8.000 and your peak cps is 12.000, set alarm to 12.000, activate to 16.000 and max to 20.000