out of the box DoS protection

[flachance]

I can't seem to find clear information for that anywhere. When deploying a gateway is there any DoS protection included/activated by default?

Or do you have to configure Rate limiting rules (sk112454)?

We're on R81.20

[Tal_Paz-Fridman · Accepted solution]

Please refer to:

Important changes in the IPS "SYN Attack" (SYN Defender) protection

https://support.checkpoint.com/results/sk/sk120476 

Also to:
sk112454 - How to configure Rate Limiting rules for DoS Mitigation in R80.20 - R81.20

https://support.checkpoint.com/results/sk/sk112454 

[flachance]

thanks. So nothing out of the box. Both have to be configured / enabled.

SYN Defender is fairly straight forward.

Rate limiting rules not so much. From the examples it looks like you have to specify a source IP. Maybe I’m not reading these rights but then you’d have to know about a problematic IP in advanced?

Also what would be a good general number for the maximum number of concurrent active connections to start with?

[the_rock]

I would enable below, if I were you. That way, fw would adjust memory/cpu usage based on amount of connections.

 

[flachance]

Thanks it's already configured this way. So i guess there is something out of the box 😁

[the_rock]

If you say so ; - )

[the_rock]

I would also refer to links Tal provided.