IPS DoS attack policies

Hi,

you need to tune this with the help of your reseller/partner.

You will need to describe in detail what you are trying to achieve.

Ian

Hello Habib Yaqubi

You only have to enable DoS for Sync, UDP and ICMP. TCP flood should be enabled only during debugging.

For Syn and UDP flood.

Packet/Min: 1200 

Packet/Sec: 200

P.S. if you are using any TS, kindly increase Syn flood to 12000-500 else you can add TS in DoS bypass Rule.

ICMP flood. 200

Regards, Ronak.

Hi Ronak,

you are suggesting dropping the Packet/Min to 1200 from 12000 which is the XG default?

Ian

Hi Ian,

Yes, I agree Sophos default value is 12000. But you can always fine tune the settings. In an ideal scenario, when a user (standalone PC and not Terminal Server) browse a site like Facebook, linkedIn, MSN the max SYN packet are 10-15/sec followed by all TCP packet.

In case of UDP application like VOIP, VPN, etc you will have to increase UDP flood to 12000+ or add DoS bypass rule. 

Regards, Ronak.

Hello Ronak,

I have enabled SYN Flood, UDP Flood and ICMP Flood on Source and Destination, but i am unable to access admin portal of Sophos xg plus internet browsing stop working in client machines.

Regard's

Habib

Hello Habib Yaqubi,

For SYN, UDP and ICMP you only have to enable on Source.

Regards, Ronak.

Hello Ronak,

 Thank you for the below instructions, I have serious problem with Connection Sessions in Sophos XG Firewall, Let me first describe the our network layout, we have place Sophos Xg Firewall in front of Cisco ASA Firewall, in Cisco ASA Firewall we have limit the connection session of WAN IP of Sophos to 2000 session. but unfortunately we are facing the connection session exceed more than 2000, internet browsing will stop working till we clear the session from cisco ASA firewall, now we increased the session to 30000 which is very risky, it also being full. i don't know what is going on. i need to troubleshoot the issue, if you have any idea please let me know.

Regard's

Habib

Hi,

2000 sessions seems a very small number, you really need to be running at least 20,000. Those figures also depend on the number of clients connecting.

Ian