Description

This article highlights some of the methods to determine threshold number for statistics-based screening and DOS protection.

Solution

Statistics based screening options: 

  1. ICMP Flood
  2. UDP Flood
  3. TCP SYN Flood Source
  4. TCP SYN Flood Destination
  5. TCP Port Scan
  6. TCP SYN-ACK-ACKProxy
  7. ICMP IP Sweep
  8. TCP Syn Flood Alarm
  9. UDP udp sweep
  10. TCP SYN Flood attack
  11. TCP SYN Flood

Firewall DoS protection options:

  1. Source based Session limits
  2. Destination based Session limits. 

The ideology behind calculating the threshold number for the above options is to find the maximum actual or expected traffic (whichever is more) flowing through the firewall. Once this baseline is found, then a buffer is added to the baseline to accommodate for minor variations in the network. Note the purpose of the above protection options is to avoid resource exhaustion of the internal protected resources (with the exception of TCP options wherein Firewall TCP blocks can be depleted). Hence, a rough estimate of the maximum expected/actual traffic is also suffice. 

There is no perfect way to define how many maximum sessions of each protocol or from the same source or to the same destination can be built. Some of the methods to gain a rough estimate are mentioned below: 

  1. Count sessions in the flow table to get an idea of how many sessions per host. These session can be counted based on the protocol, destination IP, source IP etc.

    For instance, use “show security flow session source-prefix 192.168.4.3 summary ” to get a count per host or per subnet. 
    Output: 

    root@vSRX3-node0> show security flow session source-prefix 192.168.4.3 summary 
    node0:
    --------------------------------------------------------------------------

    Valid sessions: 7
    Pending sessions: 0
    Invalidated sessions: 0
    Sessions in other states: 0
    Total sessions: 7

    node1:
    --------------------------------------------------------------------------

    Valid sessions: 7
    Pending sessions: 0
    Invalidated sessions: 0
    Sessions in other states: 0
    Total sessions: 7

    Another instance where sessions are calculated based on the protocol. 

    {primary:node0}
    root@vSRX3-node0> show security flow session protocol udp summary 
    node0:
    --------------------------------------------------------------------------

    Valid sessions: 1
    Pending sessions: 0
    Invalidated sessions: 0
    Sessions in other states: 0
    Total sessions: 1

    node1:
    --------------------------------------------------------------------------

    Valid sessions: 1
    Pending sessions: 0
    Invalidated sessions: 0
    Sessions in other states: 0
    Total sessions: 1

    These outputs should be preferred to be taken at the moment of maximum traffic i.e. during peak hours. 

  2. Monitor the traffic flowing through the firewall using traffic logging on the SRX device to any logging server or SIEM tool. A SIEM tool is expected to create a profile for the firewall which will highlight the type and amount of traffic flowing through the SRX.

  3. The configured screening options are applied on individual zones. Since SRX implicit security policy is deny for both the traffic i.e. pass-through and destined to interface, the configuration of the host-inbound-traffic and policies can highlight the expected port, protocol and IP address flowing through the firewall. Using this information, along with network administrators expertise on expected traffic for each session a baseline for the threshold can be inferred.