DoS Protection Policy Rules
Specify which resources to protect from DoS attacks and
how to protect them.
DoS Protection policy rules control the systems to which
the firewall applies DoS protection (the flood thresholds configured
in DoS Protection profiles that you attach to DoS Protection policy
rules), what action to take when traffic matches the criteria defined
in the rule, and how to log DoS traffic. Because DoS protection
consumes firewall resources, use it only to defend specific critical resources
against session floods, especially common targets that users access
from the internet, such as web servers and database servers. Use
Zone Protection profiles to protect entire zones against floods
and other attacks. DoS Protection policy rules provide granular
matching criteria so that you have the flexibility to define exactly what
you want to protect:
Source zone, interface, IP address (including whole regions), and
user.
Destination zone, interface, and IP address (including whole regions).
Services (by port and protocol). DoS protection applies only
to the services you specify. However, specifying services doesn’t
allow the services and implicitly block all other services. Specifying
services limits DoS protection to those services, but doesn’t block
other services.
In addition to protecting service ports
in use on critical servers, you can also protect against DoS attacks
on the unused service ports of critical servers. For critical systems,
you can do this by creating one DoS Protection policy rule and profile
to protect ports with services running, and a different DoS Protection
policy rule and profile to protect ports with no services running.
For example, you can protect a web server’s normal service ports,
such as 80 and 443, with one policy/profile, and protect all of
the other service ports with the other policy/profile. Be aware
of the firewall’s capacity so that servicing the DoS counters doesn’t
impact performance.
When traffic matches a DoS Protection policy rule, the firewall
takes one of three actions:
Deny—The firewall denies access and doesn’t apply
a DoS Protection profile. Traffic that matches the rule is blocked.
Allow—The firewall permits access and doesn’t apply
a DoS Protection profile. Traffic that matches the rule is allowed.
Protect—The firewall protects the devices defined
in the DoS Protection policy rule by applying the specified DoS
Protection profile or profiles thresholds to traffic that matches
the rule. A rule can have one aggregate DoS Protection profile and
one classified DoS Protection profile, and for classified profiles,
you can use the source IP, destination IP, or both to increment
the flood threshold counters, as described in
Classified Versus Aggregate DoS
Protection. Incoming packets count against both DoS Protection
profile thresholds if the they match the rule.
The firewall applies DoS Protection profiles only if the Action is Protect.
If the DoS Protection policy rule’s Action is Protect,
specify the appropriate aggregate and/or classified DoS Protection
profiles in the rule so that the firewall applies the DoS Protection
profile’s thresholds to traffic that matches the rule. Most rules
are Protect rules.
The Allow and Deny actions
enable you to make exceptions within larger groups but do not apply
DoS protection to the traffic. For example, you can deny the traffic
from most of a group but allow a subset of that traffic. Conversely,
you can allow the traffic from most of a group and deny a subset
of that traffic.
You can Schedule when a DoS Protection
policy rule is active (start and end time, recurrence period). One
use case for scheduling is to apply different flood thresholds at
different times of the day or week. For example, if your business
experiences significantly less traffic at night than during the
day, you may want to apply higher flood thresholds during the day
than at night. Another use case is to schedule special thresholds
for special events, providing that the firewall supports the CPS
rates.
For easier management and granular reporting, configure Log Forwarding to
separate DoS protection logs from other threat logs. Forward DoS
threshold violation events directly to the administrators via email
in addition to forwarding the logs to a server such an SNMP or syslog
server. Providing that the firewalls are appropriately sized, threshold
breaches should not be frequent and will be strong indicators of
an attack attempt.
