Checkpoint FW R81 don't block SYN FLOOD

[minhhaivietnam]

Hi expert,

I made a simple DOS test : flooding about 5000 syn packets from one source to firewall R81 (with SYN Attack and IPS enable).

But firewall didn't block these connections, it still accept.

SYN Attack is activated:

But fw still accept all connections

Please help , I want fw block syn flood.

Thanks all!!

[_Val_ · Accepted solution]

Check you have activated SynAttack feature properly, including the thresholds and delay. Read through sk120476, relevant portion of sk112241, and notes from SecureXL ATRG for the matter.

Also note, with the default settings, synattack has 5 seconds delay for activation. 

Instead of traffic logs, check your IPS logs for SynAttack triggers.

[minhhaivietnam · Accepted solution]

Thanks admin,

Finally, i use this command "fwaccel dos rate add concurrent-conns 100 destination cidr:192.168.199.10 service any" then it blocks as expected

Also i need to change DOS simulation :

from: 5000 packets with same source port

to: 5000 packets with random source port

[the_rock]

For sure the SK's @_Val_ sent you are super relevant in this case.

Best,

Andy