[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]

Enabling Protection Against a SYN-ACK-ACK Proxy Flood Attack

Malicious users can fill up the firewall session table to the point where the device begins rejecting legitimate connection requests by continuously initiating SYN-ACK-ACK sessions.

Before You Begin
For background information, read Understanding SYN-ACK-ACK Proxy Flood Attacks.

To enable protection against a SYN-ACK-ACK proxy flood, use either J-Web or the CLI configuration editor. The specified zone is where the attack originated.

Note: The value unit is connections per source address. The default value is 512 connections from any single address.

This topic covers:

J-Web Configuration

To configure screens:

Select Configure>CLI Tools>Point and Click CLI.
Next to Security, click Configure or Edit.
Next to Screen, click Configure.
Next to Ids option, click Add new entry.
In the Name box, type 1000-syn-ack-ack-proxy.
Next to Tcp, click Configure.
Next to Syn ack ack proxy box, select the check box and click Configure.
In the Threshold box, type 1000 and click OK.
To save and commit the configuration, click Commit.

To configure zones:

Select Configure>CLI Tools>Point and Click CLI.
Next to Security, click Configure or Edit.
Next to Zones, click Configure.
Next to Security zone, click Add new entry.
In the Name box, type zone.
In the Screen box, type 1000-syn-ack-ack-proxy and click OK.
To save and commit the configuration, click Commit.

CLI Configuration


            
               user@host# set security screen ids-option
                     1000-syn-ack-ack-proxy tcp syn-ack-ack-proxy threshold 1000
               user@host# set security zones security-zone
                     zone screen 1000-syn-ack-ack-proxy

Enabling Protection Against a SYN-ACK-ACK Proxy Flood Attack

J-Web Configuration

CLI Configuration

Related Topics