topic Re: Software Blade in General Topics

Software Blade

Di_Junior — Mon, 04 Dec 2017 15:48:47 GMT

Hi Guys,

I have a doubt about IPS software blade. I would like to know if it is possible to limit the number of connections to an internal host using the IPS software blade.

Re: Software Blade

KennyManrique — Mon, 04 Dec 2017 19:53:06 GMT

Hi Dialu,

Of course you can, please check the following IPS Protections (and Inspection Settings on R80.X):

Network Quota (limit the number of connections allowed from the same source)
Review the "Web Servers Flooding Denial of Service" protections (for HTTP, UDP and SSL)
Review the "Denial of Service" protections in general (some of them allow you to configure parameters of inspection)

Regards.

Re: Software Blade

Timothy_Hall — Mon, 04 Dec 2017 23:11:35 GMT

If SecureXL is enabled the best way to do this is using the Rate Limiting feature described in the R77 Security Gateway Technical Administration Guide. Command is fw samp add quota as shown here:

Using the IPS Network Quota signature will work as well, but will pretty much eliminate any chance of SecureXL accelerating anything whatsoever on the firewall.

--
My Book "Max Power: Check Point Firewall Performance Optimization"
Second Edition Coming Soon

Re: Software Blade

Di_Junior — Tue, 05 Dec 2017 08:18:39 GMT

Thank you.

Re: Software Blade

Di_Junior — Tue, 05 Dec 2017 08:18:50 GMT

Thank you