Prevent DNS/DoS Attack

[tropicanaslim]

Happy Weekend CheckMates.. 

But there is no weekend for mitigate an attack 🙂

so friday nite, my cust got an attack and impacted to some application can't access and dns was down.

we suspect because high rate access, either DoS or DNS attack.

Since all service already up and running well, my cust request to check and improve the current firewall which is Check Point as Perimeter Gateway.

anyone has idea how to check and analyse the issue and how we can protect from high access on dns or dos attack? Thankyou!

[the_rock]

Are there any logs you can share that could point us possibly in the right direction? Generally, make syre rules are "tightened" to only allow needed access, threat prevention blades are active (IPS at least with optimized profile at minimum).

[Alex-]

Check sk112454 - How to configure Rate Limiting rules for DoS Mitigation (R80.20 and higher) to address DoS attacks.

[Timothy_Hall]

Without knowing exactly what you were hit with, enabling the SecureXL penalty box is a great first step and easy to enable: sk112454 - How to configure Rate Limiting rules for DoS Mitigation (R80.20 and higher) If that doesn't do the trick you can look at setting some various connection and connection rate limits with fwaccel dos, that same SK has the info.  If it was just a blunt bandwidth saturation attack you'll need help from your ISP.

[Blason_R]

That is absolutely right and has proved me beneficial so many times.