Trigger/logs DoS policy

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Trigger/logs DoS policy

L4 Transporter

Hello,

 

We would like to be notified when there is a high number of requests to our servers, and even to control them in time. Aside to be able to see an event in the logs (as it is the case with the flood in the sessions)

 

The configuration we are looking for does not require (and should not) limit the number of concurrent connections.  We should only control the growth of connections over time. The idea is that, before an 'avalanche' of connections to a specific service, only 200 (for example) are allowed every 2 seconds, although after a few seconds / minutes, there are, for example, 2500 concurrent connections.

 

We have done tests (using j-meter), we observe that the DoS policy is executed, but we do not have logs or any trace or historical evidence, only We can see in real time, reviewing the status of the application of DoS policies.

 

Is that possible with PA doS policy??? how paramethers sould be configured???

2 REPLIES 2

Cyber Elite
Cyber Elite

@BigPalo,

I'm a bit confused on what you're actually looking for I guess. You can certiantly apply a maximum concurrent session limit, but you can't generically say that hosts can only create sessions at a set rate per second. That type of finer control would be set through the flood protection limits and is broken down into what you're actually looking at ( SYN UDP ICMP ect). When configuring flood protection you need to input an 'Activate' and 'Max' rate, but you can set this artifically high as to never have it trip for anyone. 

As for alerting everything applied will be recorded in the Threat logs as subtype flood. What exactly triggered the policy will also be recorded ( Session Limit Event, TCP Flood, UDP Flood, ICMP Flood, ect) and you could then setup log forwarding so that you are alerted however you want when these alerts are triggered. 

 

As for the parameters you should use, that's kind of on you to figure out. The values would be done based off of what you have recorded as the baseline. How I've configured a policy for example would have no baring or benefit if you were to apply the same policy on your own service; it's dependent on the environment that it's being deployed in. 

We would like to be adviced about connections limit against server. This is the config:1.JPG

 

1.1.JPG

 

If the same source machine launches more than 200 packets/sec, this machine will be blocked during 2 seconds.

We saw that the DoS policy is being applied but we dont see any event in threat logs. (sub type flood). Why is not showing anything in monitor->logs->threat.

 

We are simulating traffic with j-meter.

  • 2560 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!