. . . . .
A T T A C K D E T E C T I O N A N D P R E V E N T I O N
Configuring the freeGuard Blaze 2100 to Defend Against DoS and DDoS Attacks
Version 3R2
Security Appliance User Guide
5-9
CONFIGURING IP FRAGMENT PREVENTION
To limit the number of fragmented IP packets a specific interface can
receive per second, use the
set zone
command with the
ip-frag
attack-threshold
option:
set zone {zone name} screen ip-frag attack-threshold
{number}
E X A M P L E : S E T T I N G T H E I P F R A G M E N T T H R E S H O L D
Set the ip-frag threshold to
1,000
on the untrust zone:
set zone untrust screen ip-frag attack-threshold 1000
save
G U I E X A M P L E : S E T T I N G T H E I P F R A G M E N T T H R E S H O L D
1
Policy > Attack Settings Edit Zone (for “untrust”)
2
Enter the following, then click
Apply
:
IP-frag attack threshold: 1000
CONFIGURING TCP-FIN-NO-ACK
To filter packets that have a TCP-FIN bit set, but no ACK, use the
set
zone
command:
set zone {zone name} screen fin-no-ack
E X A M P L E : C O N F I G U R I N G T C P - F I N - N O - A C K
To filter packets that have a TCP-FIN bit set, but no ACK for the untrust
zone:
set zone untrust screen fin-no-ack
save
G U I E X A M P L E : C O N F I G U R I N G T C P - F I N - N O - A C K
1
Policy > Attack Settings Edit Zone (for “untrust”)
2
Select the following, then click
Apply
:
Screen FIN-no-ACK
