VPN SLOW - Intrusion Prevention DOS - UDP flood

Question

The following article fixed the issue. - EXCELENT 
 https://community.sophos.com/sophos-xg-firewall/f/discussions/129676/sophos-firewall---extremely-poor-bandwidth-when-dos-enabled/483292?focus=true 
 Unfortunately a Sophos engineer helping us was unaware that DOS UDP flood protection will ruin a perfectly good VPN. 
 Do NOT click the Apply Flag box for UDP flood Source if you have VPN clients.

Wayne Folta · Answer

Right, that's what I said: could protect against a DOS attack, not so much a DDOS attack. And it is labeled DOS, not DDOS, so there's truth in advertising at least. Except now-a-days anyone who actually has knowledge and wants to disrupt things would use a DDOS attack which the simplistic "lots of traffic from one host" doesn't do much to stop. And, as you say, an attack that manages to fill your link's download capacity will mess things up even if you stop everything at the firewall. 
 Personally, I think there should be DOS capabilities on a firewall that are oriented towards protecting the firewall itself from overload -- filling buffers/tables, causing race conditions, etc -- so it's not looking at traffic per-se but rather the impact that traffic is having on the firewall's integrity. (I.e. I can imagine an attack that floods a firewall in such a way that Snort crashes and then there's a window for sending traffic through that IPS would otherwise stop.) 
 To stop DDOS, you need an infrastructure, not a single device.

Prism · Answer

Wayne Folta said: The feature could be useful for an actual DOS attack against devices behind the firewall. 
 That's the exact problem, this feature won't protect the web server from a DDOS attack, or even your own network. 
 DDOS attacks should be mitigated by your upstream internet provider, or if It's a web server, then WAF/CDN. (Akamai/Cloudflare) 
 If the DDOS attack surpass your WAN bandwidth, then any mitigation you make directly on the Firewall will be useless.

VPN SLOW - Intrusion Prevention DOS - UDP flood

Top Replies