I have been collecting CPS (total, TCP, UDP, IP) via OIDs using PRTG for ~6 weeks. I have all the data I need (I think). However, the DoS Zone Protection best practice documentation leaves a LOT to be desired as it's not clear.
If anyone has tried to setup zone protection (SYN, UDP, IP, etc.) flood protection, and understand HOW to actually calculate the proper CPS for: Alarm, Activate, Maximum settings please explain the following:
Let's take a look at this screen capture
You stated that you have been collecting information. Great. What is the lowest CPS, what is average, and what is the highest CPS.
If you are able to answer these questions, then you should be able to determine
HOW MANY CONNECTIONS DO YOU WANT TO HAVE INBOUND TO YOUR FW?. And when do you want to limit if that number increases.
You asked about the Activate number. How many CPS (not per day, per week, month.. but per second).... how many connection per second do you want being allowed by the FW.
As for UDP traffic. Do you have much coming inbound from the Internet? Is this the area you need to focus on?
Or will it be TCP/IP, in which Syn Cookies is what you want. A client MUST provide a 3 way handshake to make a connection. So do you want to allow 1000 unanswered SYNs (known as Syn Floods) before you start to drop/restrict.
My suggestion is that you go into the Beacon training website (beacon.paloaltonetworks.com) and look at PANW 110 module on "block packet attacks" module to assist you.
Thank you for the reply @SteveCantwell . However, many of these questions cannot be answered.
I will check out the Beacon module, as soon as my access to that site is fixed. Currently have a ticket open.
Thank you @SteveCantwell - much appreciated.
I'm available tomorrow (6/23) at 4:30PM ET (3:30pm CT) if that works for you. I've been hounding my PA team about this, and they have not been able to find anyone who can explain this to me. They have admitted that they have poor resources on this topic.
I'll take any help I can get.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!