Aggressive Template for Off Ramp Mitigation

The Default Template associated with all zones is our recommended settings for full inline traffic mitigation. This assumes you have services behind our filter device where you want to see a minimum of false positives.

If you have deployed the filter devices for Off Ramp, or mitigation on demand by steering traffic through them in response to an attack, you may want to make the default settings considerably more aggressive. In these cases you may accept a higher degree of false positives for more thorough and aggressive mitigation of traffic you already know to be bad.

We recommend the following modifications from the Default Template in these cases (you can create a new empty zone without routes to make this template):

• AT1: SYN Flood
  • Maximum duplicates- 4
• AT2: SYN-ACK Flood
  • Maximum duplicates- 4
  • Uncheck 'Allow start with zero window'
• AT3: ACK and PUSH ACK Flood
  • Check 'Filter ACK packets with small data payload'
  • Small data payload size- 0
  • Maximum duplicates- 4
• AT5: RST or FIN Flood
  • Max TCP FIN/RST per ACK- 2
  • Maximum duplicates- 4
• AT8: Session Attack
  • Sensitivity level 9
• AT9: Misused Application Attack
  • Sensitivity level 9
• AT10: HTTP Fragmentation
  • Sensitivity level 9
• AT11: Excessive VERB
  • Sensitivity level 9
• AT13: Multiple VERB Single Request
  • Sensitivity level 9
• AT17: UDP Flood
  • Sensitivity level 9
• AT18: UDP Fragmentation
  • Maximum fragmented percentage- 5. This may impact clients with VPN connections who are seeing non-UDP based attacks but this can filter significantly more traffic during frag floods.
• AT19: DNS Flood
  • Uncheck 'Allow zero questions'.
  • If you know your customers' baseline level of DNS requests you may want to implement rate limiting.
• AT22: Non-Spoofed UDP Flood
  • Uncheck 'Allow SSDP traffic'
  • Block 11211 > * (memcached)
  • Block 443 > * (QUIC responses, optional)
  • Block * > 443 (QUIC requests, optional)
• AT23: ICMP Flood
  • Sensitivity level 9
• AT62: Invalid Packet Traffic
  • Check 'Drop only port 80 UDP packets'
  • Check 'Drop all other protocol packets'