Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 370 / 861

369 Preventing attacks
Enabling protection for logical network interfaces
To configure protection against port scan detections
1 In the SGMI, in the left pane, under Assets, click Network .
2 In the right pane, on the Network Interfaces tab, select the network interface on which you want to
enable protection, and then click
Properties .
3 In the Network Interface Properties dialog box, on the General tab, check Port Scan detection .
4 Click OK .
5
Optionally, do one of the following:
■
To save your configuration now and activate later, on the toolbar, click Save .
■
To activate your configuration now, on the toolbar, click Activate .
When prompted to save your changes, click Yes .
Related information
For further information related to this topic, see the following:
■
“Network Interface Properties—General tab” on page 664
Enabling SYN flood protection
Attackers may try to launch a SYN flood attack against the security gateway in hopes of crippling it
and preventing other legitimate users from connecting. SYN flood attacks are one of the most common
forms of attacks, as they are easy to understand and initiate. To deal with this type of attack, the
security gateway offers two different SYN flood protection methods: throttle and throttle with
whitelist.
How the security gateway implements SYN flood protection
A SYN flood attack exploits the fact that TCP connections require three phases to initiate a connection.
In the first phase, an attacker sends a TCP request to the security gateway with the SYN bit turned on.
The security gateway assumes this is a normal request and, in the second phase, responds with its own
packet that has both the SYN and ACK bits enabled. If this were a normal connection attempt, the
response from the source host, which happens in the third phase, would be an acknowledgement
packet (ACK enabled) and the two ends would establish the connection. However, the attacker skips the
third phase, leaving an open, pending process on the security gateway because the security gateway is
waiting for a response. If enough of these requests are initiated and left open prior to the timeout
period, the security gateway will have increased overhead dealing with all of the bogus connections,
and may take longer to respond to legitimate requests.
The security gateway offers two levels of SYN flood protection to help combat SYN flood attacks:
throttle and throttle with whitelist. The throttle option instructs the security gateway to rate-limit the
number of new connections when it believes that it is the target of a SYN flood attack. The security
gateway keeps the number of new connections at or below the rate limit, and drops any additional
connections that exceed this value. The second option is similar to throttle mode, but adds the ability
to allow connections from any host listed in a whitelist. If you use this mode, the source IP address for
incoming connections are first parsed against the whitelist. If the address appears in the whitelist, the
connection is automatically added, and does not count against rate limit.
Configuring SYN flood protection
Configuring SYN flood protection on an interface instructs the security gateway to monitor the
numbered of unanswered TCP connections and to throttle new ones appropriately. SYN flood
protection is designed to let known connections through, while throttling back new, unanswered
requests. Enabling SYN flood protection should be done only when you suspect your system might be
under attack, as this feature may decrease performance. Changes take affect after activating the
change in a new configuration.