Quantum CHECK POINT SPARK 1500 Series, Administration Manual

Page: 127 / 300

Advanced Settings
Quantum Spark 1500, 1600 and 1800 Appliance Series R80.20.40 Locally Managed Administration Guide | 127
Aggressive
Aging
Attribute
Description
To configure Aggressive Aging:
1. Select Enable Aggressive Aging of connections when appliance is
under load .
2. To log Aggressive Aging events, select Log Aggressive Aging
events . The logs are shown in Logs & Monitoring > Security Logs
under the IPS blade.
3. Select the checkboxes of the Aggressive Aging Timeouts that you
want to enforce and enter the Aggressive Aging timeout. Make sure
that the Aggressive timeouts are lower than the default timeouts.
The default timeouts can be viewed and configured in the
Device >
Advanced Settings > Stateful Inspection attributes .
To configure when the Aggressive Aging timeouts are enforced:
1. Under Aggressive Aging Timeouts are enforced when section,
select whether they are enforced if the connections table exceeds a
limit, if memory exceeds a limit, or if both exceed their limits.
2. Enter the percentage that you want to define as the limit to either
connections table or memory consumption. If you select both, the
values in the percentage fields of the other options are applied.
Default is 80%, with connections from the "eligible for deletion" list
being deleted if either the connections table or memory consumption
passes this limit.
Table: Aggressive Aging Attributes (continued)
Anti ARP spoofing
Attribute
Description
Anti ARP spoofing
mode Mode for Anti ARP spoofing protection. The protection can be turned
off, on, or in detect only mode.
Detection window
time to indicate
attack Time period (in seconds) during which IP addresses, assigned to the
same MAC address, indicate an ARP spoofing attack.
Number of IP
addresses to
indicate attack The number of IP addresses assigned to the same MAC address
during the Detection window time that will an indicate an ARP spoofing
attack.
Suspicious MAC
block period Time period (in seconds) during which suspicious MAC addresses are
kept in the blocked list.
Table: Anti ARP Spoofing Attributes