Classified Versus Aggregate DoS Protection

• Aggregate—Sets thresholds that apply to the entire group of devices specified in a DoS Protection policy rule instead of to each individual device, so one device could receive the majority of the allowed connection traffic. For example, a Max Rate of 20,000 CPS means the total CPS for the group is 20,000, and an individual device can receive up to 20,000 CPS if other devices don’t have connections. Aggregate DoS Protection policies provide another layer of broad protection (after your dedicated DDoS device at the internet perimeter and Zone Protection profiles) for a particular group of critical devices when you want to apply extra constraints on specific subnets, users, or services.
• Classified—Sets flood thresholds that apply to each individual device specified in a DoS Protection policy rule. For example, if you set an Max Rate of 5,000 CPS, each device specified in the rule can accept up to 5,000 CPS before it drops new connections. If you apply a classified DoS Protection policy rule to more than one device, the devices governed by the rule should be similar in terms of capacity and how you want to control their CPS rates because classified thresholds apply to each individual device. Classified profiles protect individual critical resources.
  When you configure a DoS Protection policy rule with a classified DoS Protection profile (Option/ProtectionClassifiedAddress), use the Address field to specify whether incoming connections count toward the profile thresholds based on matching the source-ip-only, destination-ip-only, or scr-dest-ip-both (the firewall counts both the source and the destination IP address matches toward the thresholds). Counters consume resources, so the way you count address matches affects firewall resource consumption. You can use classified DoS protection to:
  • Protect critical individual devices, especially servers that users access from the internet and are often attack targets, such as web servers, database servers, and DNS servers. Set appropriate flood and resource protection thresholds in a classified DoS Protection profile. Create a DoS Protection policy rule that applies the profile to each server’s IP address by adding the IP addresses as the rule’s destination criteria, and set the Address to destination-ip-only.
    Do not use source-IP-only or src-dest-ip-both classification for internet-facing zones in classified DoS Protection policy rules because the firewall doesn’t have the capacity to store counters for every possible IP address on the internet. Increment the threshold counter for source IPs only for internal zone or same-zone rules. In perimeter zones, use destination-ip-only.
  • Monitor the CPS rate for a suspect host or group of hosts (the zone that contains the hosts cannot be internet-facing). Set an appropriate alarm threshold in a classified DoS Protection profile to notify you if a host initiates an unusually large number of connections. Create a DoS Protection policy rule that applies the profile to the individual source or source address group and set the Address to source-ip-only. Investigate hosts that initiate enough new connections to set off the alarm.

• Hardware ACL blocking must be supported and enabled on your firewall to use both the hardware and software block tables. The firewalls that support hardware ACL blocking are the PA-3200 Series, PA-5200 Series, PA-7000 Series, and PA-7500 firewalls.
• By default, the hardware ACL blocking duration is set to 30 seconds. Enter set system setting hardware-acl-blocking-duration <seconds> into the CLI to adjust the duration, where <seconds> is a value between 1 and 3,600.

• The new CPS rate exceeds the aggregate Max Rate but doesn’t exceed the classified Max Rate. In this scenario, the firewall applies the aggregate profile and blocks all new connections for the configured Block Duration.
• The new CPS rate doesn’t exceed the aggregate Max Rate, but the CPS to one of the web servers exceeds the classified Max Rate. In this scenario, the firewall checks the aggregate profile and finds that the rate for the group is less than 25,000 CPS, so the firewall doesn’t block new connections based on that. Next, the firewall checks the classified profile and finds that the rate for a particular server exceeds 6,000 CPS. The firewall applies the classified profile and blocks new connections to that particular server for the configured Block Duration. Because the other servers in the group are within the classified profile’s Max Rate, their traffic is not affected.
• The new CPS rate exceeds the aggregate Max Rate and also exceeds the classified Max Rate for one of the web servers. In this scenario, the firewall checks the aggregate profile and finds that the rate for the group exceeds 25,000 CPS, so the firewall blocks new connections to limit the group’s total CPS. The firewall then checks the classified profile and finds that the rate for a particular server exceeds 6,000 CPS (so the aggregate profile enforced the group’s combined limit, but that wasn’t enough to protect this particular server). The firewall applies the classified profile and blocks new connections to that particular server for the configured Block Duration. Because the other servers in the group are within the classified profile’s Max Rate, their traffic is not affected.