Firewall
Configuring the Attack Protection
Cisco ISA500 Series Integrated Security Appliance Administrator Guide
207
6
•
IP Address:
Choose an existing IP address object that you want to bind with
the selected MAC address. If the IP address object you want is not in the list,
choose
Create an IP Address
to add a new IP address object. To maintain
the IP address objects, go to the
Networking -> Address Object
Management
page. See
•
Log Dropped Packets:
Choose
Enable
to log all packets that are dropped.
Otherwise, choose
Disable
.
STEP 4
Click
OK
to save your settings.
STEP 5
Click
Save
to save your settings.
Configuring the Attack Protection
Use the Attack Protection page to specify how to protect your network against
common types of attacks including discovery, flooding, and echo storms.
STEP 1
Click
Firewall
-> Attack Protection
.
The Attack Protection window opens.
STEP 2
In the
WAN Security Checks
area, enter the following information:
•
Block Ping to WAN interface:
Check the box to prevent attackers from
discovering your network through ICMP Echo (ping) requests. We
recommend that you disable this feature only if you need to allow the
security appliance to respond to pings for diagnostic purposes.
•
Enable Stealth Mode:
Check the box to prevent the security appliance from
responding to incoming connection requests from the WAN. In Stealth Mode,
your security appliance does not respond to blocked inbound connection
requests, and your network is less susceptible to discovery and attacks.
•
Block TCP Flood:
Check this box to drop all invalid TCP packets. This feature
protects your network from a SYN flood attack, in which an attacker sends a
succession of SYN (synchronize) requests to a target system. It blocks all
TCP SYN flood attackes (200 packets per seconds) from the WAN
interfaces.
STEP 3
In the
LAN Security Checks
section, enter the following information:
