Cisco ISA500 Series Administration Manual page 214

Firewall
Configuring the Attack Protection
STEP 4
STEP 5
STEP 6
Cisco ISA500 Series Integrated Security Appliance Administrator Guide
• Block UDP Flood: Check the box to prevent the security appliance from
accepting more than 200 simultaneous, active UDP connections per second
from a single computer on the LAN.
In the Firewall Settings area, enter the following information:
• Block ICMP Notification: Check the box to silently block without sending an
ICMP notification to the sender. Some protocols, such as MTU Path
Discovery, require ICMP notifications.
• Block Fragmented Packets: Check the box to block fragmented packets
from Any zone to Any zone.
• Block Multicast Packets: Check the box to block multicast packets. By
default, the firewall blocks all multicast packets. This feature has higher
priority than the firewall access rules, which means that the firewall access
rules that permit the multicast traffic will be overrided if you enable this
feature.
In the DoS Attacks area, enter the following information:
• SYN Flood Detect Rate (max/sec): Enter the maximum number of SYN
packets per second that will cause the security appliance to determine that
a SYN Flood Intrusion is occurring. Enter a value from 0 to 10000 SYN
packets per second. A value of zero indicates that the SYN Flook Detect
feature is disabled.
• Echo Storm (ping pkts./sec): Enter the number of pings per second that will
cause the security appliance to determine that an echo storm intrusion event
is occurring. Enter a value from 0 to 10000 ping packets per second. A value
of zero indicates that the Echo Storm feature is disabled.
• ICMP Flood (ICMP pkts./sec): Enter the number of ICMP packets per
second, including PING packets, that will cause the security appliance to
determine that an ICMP flood intrusion event is occurring. Enter a value from
0 to 10000 ICMP packets per second. A value of zero indicates that the IGMP
Flood feature is disabled.
Click Save to apply your settings.
6
208