Cisco SA520-K9 Administration Guide - Page 119

Configuring MAC Filtering to Allow or Block Traffic, SYN Flood Detect Rate max/sec

Get Cisco SA520-K9 - SA 500 Series Security Appliances PDF manuals and user guides
UPC - 882658266744
View all Cisco SA520-K9 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 119 highlights

Firewall Configuration Using Other Tools to Prevent Attacks, Restrict Access, and Control Inbound Traffic 4 STEP 5 In the DoS Attacks area, enter the following information: • SYN Flood Detect Rate (max/sec): Enter the maximum number of SYN packets per second that will cause the security appliance to determine that a SYN Flood Intrusion is occurring. This value can range between 1 and 10,000 packets per second. The default is 128 SYN packets per second. • Echo Storm (ping pkts/sec): Enter the number of pings per second that will cause the security appliance to determine that an echo storm intrusion event is occurring. Echo storm intrusion events are not blacklisted. This value can range between 1 and 10,000 ping packets per second. The default is 15 ping packets per second. • ICMP Flood [ICMP pkts./sec]: Enter the number of ICMP packets per second, not including PING packets, that will cause the security appliance to determine that an ICMP flood intrusion event is occurring. ICMP flood events are not blacklisted. This value can range between 1 and 10,000 ICMP packets per second. The default is 100 ICMP packets per second. STEP 6 Click Apply to save your settings. Configuring MAC Filtering to Allow or Block Traffic You can restrict (block or allow) traffic to the WAN and DMZ from the LAN based on the MAC address of the device. The first step is to populate the list of MAC addresses to be covered by the filtering policy. You can configure the policy either to block all MAC addresses in the list and permit the rest, or to permit only the configured MAC addresses and block the rest. STEP 1 Click Firewall > MAC Filtering > MAC Filtering. The Source MAC Filter window opens. Before you can add any addresses to the table, you must check the box to enable MAC filtering, and then click Apply. STEP 2 In the MAC Filtering Enable area, enter the following information: • Enable MAC Address Filtering?: Check the box to enable Source MAC Address Filtering. • Policy for MAC Addresses listed below: Choose one of the following options: Cisco SA500 Series Security Appliances Administration Guide 119

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
  • 231
  • 232
  • 233
  • 234
  • 235
  • 236
  • 237
  • 238
  • 239
  • 240
Firewall Configuration
Using Other Tools to Prevent Attacks, Restrict Access, and Control Inbound Traffic
Cisco SA500 Series Security Appliances Administration Guide
119
4
STEP 5
In the
DoS Attacks
area, enter the following information:
•
SYN Flood Detect Rate (max/sec):
Enter the maximum number of SYN
packets per second that will cause the security appliance to determine that
a SYN Flood Intrusion is occurring. This value can range between 1 and
10,000 packets per second. The default is 128 SYN packets per second.
•
Echo Storm (ping pkts/sec):
Enter the number of pings per second that will
cause the security appliance to determine that an echo storm intrusion event
is occurring. Echo storm intrusion events are not blacklisted. This value can
range between 1 and 10,000 ping packets per second. The default is 15
ping packets per second.
•
ICMP Flood [ICMP pkts./sec]:
Enter the number of ICMP packets per
second, not including PING packets, that will cause the security appliance to
determine that an ICMP flood intrusion event is occurring. ICMP flood events
are not blacklisted. This value can range between 1 and 10,000 ICMP
packets per second. The default is 100 ICMP packets per second.
STEP
6
Click
Apply
to save your settings.
Configuring MAC Filtering to Allow or Block Traffic
You can restrict (block or allow) traffic to the WAN and DMZ from the LAN based
on the MAC address of the device. The first step is to populate the list of MAC
addresses to be covered by the filtering policy. You can configure the policy either
to block all MAC addresses in the list and permit the rest, or to permit only the
configured MAC addresses and block the rest.
STEP 1
Click
Firewall
> MAC Filtering > MAC Filtering
. The Source MAC Filter window
opens.
Before you can add any addresses to the table, you must check the box to enable
MAC filtering, and then click
Apply.
STEP
2
In the
MAC Filtering Enable
area, enter the following information:
•
Enable MAC Address Filtering?:
Check the box to enable Source MAC
Address Filtering.
•
Policy for MAC Addresses listed below:
Choose one of the following
options: