zone protection

[Westcon2]

How do we block synfin port scan.

[bat]

I think the syn+fin packets should drop without zone protection or DoS policy in place.

[Westcon2]

Can we confirm if synfin are dropped by default without zp and Dos policy. 

Thank You Sharma and Hardik. I have checked the zp in the threat logs. It is same what you showed in the screen shot.

[ssharma]

Any non-syn is dropped by default. But if an attack occurs and firewall is bombarded with syn-fin packets, it will open a session with syn packet and kill the session with fin.  If the rate is excessive for syn-fin then cpu might go really high. So zone protection will help in that scenario.  Hope this helps.

[ttanzi]

Does anyone now if there is a way to proactively alert when a port scan has been detected? In the threat logs, I can see the alert of a port scan but the severity level is medium and the alert id is 8001 and you cannot change the severity. We are sending email alerts on all critical threats and we do not want to start sending email alerts on severity of medium as this will generate a lot of noise. 

thanks all in advance

[pulukas]

You can follow the procedure in DOC-3779 to fire an email for a specific threat.  It does require setting up a specific policy and email profile to fire the alert.

How to Receive Email Threat Notification from the firewall