This solution can be effective in scenarios where the attacker bypasses the standard Screen options by using specific traffic patterns or evasion techniques.

Prerequisite:

To apply this approach effectively, it is essential to first capture and analyze the DDoS traffic using tools like tcpdump or packet capture. Understanding the traffic behavior is key to tailoring the mitigation strategy appropriately.

The primary symptom of the DDoS attack is that the Routing Engine (RE) becomes overwhelmed and experiences high CPU utilization. As a result, certain features or software modules may stop responding. In some cases, this may require a process restart or even a full system reboot to temporarily recover functionality.

However, since the source of the attack is external to the SRX, the system is likely to become overwhelmed again if the attacker continues the traffic, leading to repeated service impact.

This solution addresses a custom DDoS attack where the attacker sends unencrypted HTTP traffic over TCP port 443, attempting to bypass traditional protections and overload the system. The approach uses a custom IDP signature, a dedicated IDP policy, and a security policy to detect and block the offending traffic.

Note: Before implementation, ensure this pattern aligns with your observed traffic. Adjust configurations as needed based on your network’s design and business requirements.

A. Define Custom Attack Signature (Context: http-request-method)

set security idp custom-attack JTAC recommended-action drop
set security idp custom-attack JTAC severity critical
set security idp custom-attack JTAC detection-filter count 5
set security idp custom-attack JTAC detection-filter scope destination
set security idp custom-attack JTAC detection-filter interval 01m-00s
set security idp custom-attack JTAC attack-type signature protocol-binding tcp minimum-port 443
set security idp custom-attack JTAC attack-type signature context http-request-method
set security idp custom-attack JTAC attack-type signature pattern .*
set security idp custom-attack JTAC attack-type signature direction client-to-server

B. Define IDP Policy

Optional: You can add an exempt rulebase to allow legitimate traffic through while still inspecting and blocking malicious traffic.

set security idp idp-policy TEST rulebase-ips rule DDOS match source-address any
set security idp idp-policy TEST rulebase-ips rule DDOS match destination-address <SRX_IP_or_Object>
set security idp idp-policy TEST rulebase-ips rule DDOS match application TCP-443
set security idp idp-policy TEST rulebase-ips rule DDOS match attacks custom-attacks JTAC
set security idp idp-policy TEST rulebase-ips rule DDOS then action drop-connection
set security idp idp-policy TEST rulebase-ips rule DDOS then ip-action ip-block
set security idp idp-policy TEST rulebase-ips rule DDOS then ip-action target source-address
set security idp idp-policy TEST rulebase-ips rule DDOS then ip-action log
set security idp idp-policy TEST rulebase-ips rule DDOS then ip-action timeout 64800
set security idp idp-policy TEST rulebase-ips rule DDOS then notification log-attacks

C. Apply IDP Policy to Security Policy

Note: Replace INTERNET with the zone receiving inbound DDoS traffic, and ensure this policy is placed at the top of the policy list for proper evaluation

set security policies from-zone INTERNET to-zone junos-host policy JTAC match source-address any

set security policies from-zone INTERNET to-zone junos-host policy JTAC match destination-address JSC

set security policies from-zone INTERNET to-zone junos-host policy JTAC match application any

set security policies from-zone INTERNET to-zone junos-host policy JTAC then permit application-services idp-policy TEST

set security policies from-zone INTERNET to-zone junos-host policy JTAC then log session-init

set security policies from-zone INTERNET to-zone junos-host policy JTAC then log session-close

set security policies from-zone INTERNET to-zone junos-host policy JTAC then count

D. Validation and Monitoring

Use the following operational commands to validate functionality and monitor impact:

show security flow ip-action
clear security flow ip-action  >>> Clears blocked IP list

show security idp counters action
show security idp attack table
show security idp counter packet
show security idp counter action
show security idp counter flow
monitor security packet-drop

Note: This solution doesn't require an IDP license to work and effectively works if it is combined with screen options configured for DDoS protection.