Policies > DoS Protection

A DoS Protection policy allow you to protect against DoS attacks by specifying whether to deny or allow packets that match a source interface, zone, address or user, and/or a destination interface, zone, or user.

Alternatively, you can choose the Protect action and specify a DoS profile where you set the thresholds (sessions or packets per second) that trigger an alarm, activate a protective action, and indicate the maximum rate above which packets are dropped. Thus, you can control the number of sessions between interfaces, zones, addresses, and countries based on aggregate sessions or source and/or destination IP addresses. For example, you can control traffic to and from certain addresses or address groups, or from certain users and for certain services.

The firewall enforces DoS Protection policy rules before Security policy rules to ensure the firewall uses its resources in the most efficient manner. If a DoS Protection policy rule denies a packet, that packet never reaches a Security policy rule.

Use this page to Add, edit, or delete DoS Protection policy rules.

The following tables describe the captive portal policy settings:

Looking for more?

See Dos Protection Against Flooding of New Sessions .

Select the General tab to configure a name and description for the DoS Protection policy. You can also configure a tag to allow you to sort or filter policies when many policies exist.

Select the Source tab to define the source interface(s) or source zone(s), and optionally the source address(es) and source user(s) that define the incoming traffic to which the DoS policy rule applies.

Select the Destination tab to define the destination zone or interface and destination address that define the destination traffic to which the policy applies.

Select the Option/Protection tab to configure options for the DoS Protection policy rule, such as the type of service (http or https) to which the rule applies, the action to take against packets that match the rule, and whether or not to trigger a log forward for matched traffic. You can define a schedule for when the rule is active.

You can also select an aggregate DoS Protection profile and/or a classified DoS Protection profile, which determine the threshold rates that, when exceeded, cause the firewall to take protective actions, such as trigger an alarm, activate an action such as Random Early Drop, and drop packets that exceed the maximum threshold rate.