zone protection test doc.

[bhlee]

Hello all.

I tested some of the DOS/DDOS tool set against PA-4050.

I want to share my humble doc to you.

some of them still remain question to me.. I'll open the support case for that.

if you have some input, please email me.

thank you~.

BH Lee

[jpa]

Hello Lee

Thank you for the detailed analysis. From looking at your document, i see that the victim is DDOS_External zone and you have applied the zone protection in the DDOS_Internal zone. All your traffic logs show the source and destination zone to be DDOS_Internal zone.

Zone protection profile must be applied to the destination zone, the zone where the victim is connected. Can you pls confirm your topology is correct representation of how the devices are physically connected?  I would like to look at the configuration on your device.

Thank you

Jerish

[bhlee]

thank you for the response.

as you recommended(destination zone), I only applied the zone protection profile where victim is reside.

but the test result is same..

when UDP dst port is fixed, both zone protection and dos protection failed to enforce it's rule.

more interesting one is.. when sending '19)non spoofed DNS attack' packet, the pkt_recv cnt never goes up.. the rate is remain same..(firmware 3.1.7 and firmware 4.0.1 show same result)

is there anything that I'm missing?

I'm drawing the blank..

Global counters:
Elapsed time since last sampling: 374.668 seconds

name                                 value     rate severity  category  aspect    description
--------------------------------------------------------------------------------
pkt_recv                              1081        2 info      packet    pktproc   Packets received
pkt_sent                               685        1 info      packet    pktproc   Packets transmitted
pkt_alloc                              446        1 info      packet    resource  Packets allocated

any input will be appreciate.

thank you very much.

BH Lee