Firewall
Configuring Attack Protection
Cisco ISA500 Series Integrated Security Appliances Administration Guide 287
6
Use the Attack Protection page to specify how to protect your network against
common types of attacks including discovery, flooding, and echo storms.
STEP 1 Click Firewall > Attack Protection.
STEP 2 In the WAN S ecuri ty Che cks area, enter the following information:
•Block Ping WAN Interface: Check this box to prevent attackers from
discovering your network through ICMP Echo (ping) requests. We
recommend that you disable this feature only if you need to allow the
security appliance to respond to pings for diagnostic purposes.
•Stealth Mode: Check this box to prevent the security appliance from
responding to incoming connection requests from the WAN ports. In Stealth
Mode, the security appliance does not respond to blocked inbound
connection requests, and your network is less susceptible to discovery and
attacks.
•Block TCP Flood: Check this box to drop all invalid TCP packets. This feature
protects your network from a SYN flood attack, in which an attacker sends a
succession of SYN (synchronize) requests to a target system. It blocks all
TCP SYN flood attacks (more than 200 simultaneous TCP packets per
second) from the WAN ports.
STEP 3 In the LAN Security Checks section, enter the following information:
•Block UDP Flood: Check this box to limit the number of simultaneous, active
UDP connections from a single computer on the LAN. If you enable this
feature, also enter the number of connections to allow per host per second.
The default value is 500, and the valid range is from 100 to 10,000. When this
limit is reached, the security appliance considers it a UDP flood attack and
drops all connections from the host.
STEP 4 In the Firewall Settin gs area, enter the following information:
•Block ICMP Notification: Check this box to silently block without sending an
ICMP notification to the sender. Some protocols, such as MTU Path
Discovery, require ICMP notifications.
•Block Fragmented Packets: Check this box to block fragmented packets
from Any zone to Any zone.