- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
Enhanced Security Measures in Place: To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.
10-10-2014 12:14 PM
You can configure zone protection on your outside zone or zone that you are more concerned about.
You can define various action. In above example, I have asked firewall to block source IP for 300 secs if that ip is trying to scan the tcp port. You can customize the alert and threshold as well. Hope this helps. Thank you.
10-10-2014 12:33 PM
I have applied zone protection policy and it is set on alert.
I tried to port scan using nmap. however i could not see any hits using the command show counter global name flow_parse_l4_tcpsynfin.
Is there any way to see the zone protection logs.
10-10-2014 12:34 PM
Hi Westcon,
Zone Protection has ability to block port scan. You can find all relevant configuration in following link.
Let us know for additional granular information.
Regards,
Hardik Shah
10-10-2014 12:36 PM
Hi Westcon,
You can find zone protection logs in Monitor > Threat.
It seems Nmap may not be crossing zone protection scan limit/second.
Would you share zone protection configuration along with Nmp scan rate ?
Regards,
Hardik Shah
10-10-2014 12:36 PM
Do you see any drops in the output of this command:
show zone-protection zone <zone-name>
10-10-2014 12:47 PM
I am using two firewalls. once is having an old setup and the other recently deployed.
The out put of the command show counter global name flow_parse_l4_tcpsynfin is as below.
My question is that does the firewall have the ability to drop the synfin packets automatically or do we need to apply the zp or dos policy.
Below is the output
Firewall 1 without zone protection
Name: flow_parse_l4_tcpsynfin
Value: 5709
Severity: Drop
Category: flow
Aspect: parse
Desciption: Packets dropped: invalid TCP flags (SYN+FIN+*)
Firewall 2
admin@Lab-Firewall> show counter global name flow_parse_l4_tcpsynfin
Name: flow_parse_l4_tcpsynfin
Value: 0
Severity: Drop
Category: flow
Aspect: parse
Desciption: Packets dropped: invalid TCP flags (SYN+FIN+*)
10-10-2014 12:49 PM
Hi Westcon,
Provide us following output. Whic will list all kind of latest drop.
1. Execute command "show counter global filter delta sev drop"
2. Run NMAP
3. Run again "show counter global filter delta sev drop"
Provide us output for 3rd pointer
Regards,
Hardik Shah
10-10-2014 12:56 PM
Hi Westcon2,
If zone protection is triggered, you can see it under threat logs.
If you have flood attacks, you will Flood attacks warning as well.
10-10-2014 01:01 PM
I think the syn+fin packets should drop without zone protection or DoS policy in place.
10-10-2014 01:16 PM
Can we confirm if synfin are dropped by default without zp and Dos policy.
Thank You Sharma and Hardik. I have checked the zp in the threat logs. It is same what you showed in the screen shot.
10-10-2014 01:31 PM
Any non-syn is dropped by default. But if an attack occurs and firewall is bombarded with syn-fin packets, it will open a session with syn packet and kill the session with fin. If the rate is excessive for syn-fin then cpu might go really high. So zone protection will help in that scenario. Hope this helps.
12-22-2014 12:19 PM
Does anyone now if there is a way to proactively alert when a port scan has been detected? In the threat logs, I can see the alert of a port scan but the severity level is medium and the alert id is 8001 and you cannot change the severity. We are sending email alerts on all critical threats and we do not want to start sending email alerts on severity of medium as this will generate a lot of noise.
thanks all in advance
12-22-2014 01:12 PM
You can follow the procedure in DOC-3779 to fire an email for a specific threat. It does require setting up a specific policy and email profile to fire the alert.
How to Receive Email Threat Notification from the firewall
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!