Checkpoint FW R81 don't block SYN FLOOD

[minhhaivietnam]

Hi expert,

I made a simple DOS test : flooding about 5000 syn packets from one source to firewall R81 (with SYN Attack and IPS enable).

But firewall didn't block these connections, it still accept.

SYN Attack is activated:

But fw still accept all connections

Please help , I want fw block syn flood.

Thanks all!!

[_Val_ · Accepted solution]

Check you have activated SynAttack feature properly, including the thresholds and delay. Read through sk120476, relevant portion of sk112241, and notes from SecureXL ATRG for the matter.

Also note, with the default settings, synattack has 5 seconds delay for activation. 

Instead of traffic logs, check your IPS logs for SynAttack triggers.

[minhhaivietnam · Accepted solution]

Thanks admin,

Finally, i use this command "fwaccel dos rate add concurrent-conns 100 destination cidr:192.168.199.10 service any" then it blocks as expected

Also i need to change DOS simulation :

from: 5000 packets with same source port

to: 5000 packets with random source port

[the_rock]

For sure the SK's @_Val_ sent you are super relevant in this case.

Best,

Andy

[ANARINE]

Ok I performed the syn flood in my testlab as well. I have observed the below

When syn flood prevention aka syndefender is enabled, it only activates after the threshold is reached (default 5000 syns). You can confirm that syndefender is active and enforcing cookies by running the 'fwaccel monitor state' command). At this point the fw acts as man-in-the-middle: It does not forward the SYN packet to the web server unless it received an ACK from the client containing a valid cookie. The OP was looking for syn drops in the fw logs, but the fw doesn't drop the syns, it just doesn't forward them to the webserver. The OP enabled a dos rate policy which is a separate mechanism from syndefender.

The below sk explains the process

Accelerated SYN Defender