How to stop tcp syn-flood attack in SSR.

The SSR platform offers strong, built-in defenses against DoS and DDoS attacks. Its session-aware, zero-trust architecture, combined with deep packet validation and resource isolation, ensures that only authenticated, authorized traffic is processed. These validations are lightweight and designed to operate efficiently under high-volume conditions, allowing the router to maintain performance even during attempted attacks. This functionality works without any additional configuration. However user may notice open ports during the vulnerability scan. Security team might not understand the subtlety here and why this doesn't really indicate an open port. They just want a scan to run clean. So we can change that behavior by using the additional CLI command.

By running the below cmd in MIST SSR CLI option, only the peer SSR's will be able to communicate between each other. Other invalid connections are dropped. DNAT functionality will not be affected.

#config authority session-recovery-detection mode inactivity-based 

Note: You will need to make that change on all the routers or else they won't be able to negotiate their stuck session mitigation behaviour.