Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
tropicanaslim
Contributor

Prevent DNS/DoS Attack

Happy Weekend CheckMates.. 

But there is no weekend for mitigate an attack 🙂

so friday nite, my cust got an attack and impacted to some application can't access and dns was down.

we suspect because high rate access, either DoS or DNS attack.

 

Since all service already up and running well, my cust request to check and improve the current firewall which is Check Point as Perimeter Gateway.

anyone has idea how to check and analyse the issue and how we can protect from high access on dns or dos attack? Thankyou!

0 Kudos
4 Replies
the_rock
Legend
Legend

Are there any logs you can share that could point us possibly in the right direction? Generally, make syre rules are "tightened" to only allow needed access, threat prevention blades are active (IPS at least with optimized profile at minimum).

0 Kudos
Alex-
Leader Leader
Leader

Timothy_Hall
Legend Legend
Legend

Without knowing exactly what you were hit with, enabling the SecureXL penalty box is a great first step and easy to enable: sk112454 - How to configure Rate Limiting rules for DoS Mitigation (R80.20 and higher) If that doesn't do the trick you can look at setting some various connection and connection rate limits with fwaccel dos, that same SK has the info.  If it was just a blunt bandwidth saturation attack you'll need help from your ISP.

Gateway Performance Optimization R81.20 Course
now available at maxpowerfirewalls.com
(1)
Blason_R
Leader
Leader

That is absolutely right and has proved me beneficial so many times. 

Thanks and Regards,
Blason R
CCSA,CCSE,CCCS
0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events