You can configure Aggregate and Classified DoS Protection profiles. You can apply an Aggregate profile, a Classified profile, or one of each type to a DoS Protection policy rule. If you apply both profile types to a rule, the firewall applies the Aggregate profile first and then applies the Classified profile if needed.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
•
|
Aggregate—Apply the DoS thresholds configured in the profile to all connections that match the rule criteria on which this profile is applied. For example, an aggregate rule with a SYN flood Alarm Rate threshold of 10,000 CPS counts the combined connections of all the devices that match the DoS rule. When the total CPS for the group exceeds 10,000 CPS that triggers the alarm, regardless of how the CPS are spread across the devices.
|
|
•
|
Classified—Apply the DoS thresholds configured in the profile to each individual connection that matches the classification criteria (source IP address, destination IP address, or source-and-destination IP address pair). For example, a classified rule with a SYN flood Alarm Rate threshold of 10,000 CPS allows up to 10,000 CPS per device and triggers an alarm when any individual device specified in the DoS rule exceeds 10,000 CPS.
|
|
|
|
|
|
|
•
|
Action—( SYN Flood only) Action that the firewall performs if the DoS Protection policy action is Protect and if incoming CPS reach the Activate Rate. Choose one of the following:
|
|
◦
|
Random Early Drop—Drop packets randomly when connections per second reach the Activate Rate threshold.
|
|
◦
|
SYN cookies—Use SYN cookies to generate acknowledgments so that it is not necessary to drop connections during a SYN flood attack.
|
|
•
|
Alarm Rate—Specify the threshold rate (CPS) to generate a DoS alarm (range is 0 to 2,000,000 cps; default is 10,000 cps).
|
|
•
|
Activate Rate—Specify the threshold rate (cps) at which a DoS response is activated. The DoS response is configured in the Action field of the DoS Protection profile (Random Early Drop or SYN cookies). The Activate Rate range is 0 to 2,000,000 cps; default is 10,000 cps.
|
If the profile Action is Random Early Drop (RED), when incoming connections per second reach the Activate Rate threshold, RED occurs. If the CPS rate increases, the RED rate increases according to an algorithm. The firewall continues with RED until the CPS rate reaches the Max Rate threshold.
|
•
|
Max Rate—Specify the threshold rate of incoming connections per second the firewall allows. At the Max Rate threshold, the firewall drops 100% of new connections (range is 2 to 2,000,000 cps; default is 40,000 cps.)
|
For Classified profiles, base the Max Rate on the capacity of the devices you’re protecting so they can’t be flooded. For Aggregate profiles, set the Max Rate to 80-90% of the group’s capacity. Monitor and adjust the thresholds as needed.
|
•
|
Block Duration—Specify the length of time (seconds) during which the offending IP address remains on the Block IP list and connections with the IP address are blocked. The firewall doesn’t count packets that arrive during the block duration toward the Alarm Rate, Activate Rate, or Max Rate thresholds (range is 1 to 21,600 seconds; default is 300 seconds).
|
|
|
|
|
|
|
|
|
|
•
|
For the Aggregate profile type, this limit applies to all traffic hitting the DoS Protection rule on which the DoS Protection profile is applied.
|
|
•
|
For the Classified profile type, this limit applies to the traffic on a classified basis (source IP, destination IP or source-and-destination IP) hitting the DoS Protection rule to which the DoS Protection profile is applied.
|
|
