WatchGuard Firebox System 7.0 User Guide

Chapter 11: Intrusion Detection and Preventionprotection feature will self-activate. Once active, furtherconnection attempts from the external side of the Fireboxmust be verified before being allowed to reach your servers.Connections that cannot be verified are not allowedthrough, thus protecting your server from having a fullbacklog.The SYN Flood protection feature will self-deactivate whenit senses the attack is over.From Policy Manager:1 On the toolbar, click the Default Packet Handling icon.You can also, from Policy Manager, select Setup => IntrusionPrevention => Default Packet Handling.The Default Packet Handling dialog box appears.2 Select the checkbox marked Block SYN Flood Attacks.Changing SYN flood settingsActive SYN flood defenses can occasionally prevent legitimateconnection attempts from being completed. If youfind that too many legitimate connection attempts failwhen your SYN flood defense is active, you can changeSYN flood settings to minimize this problem.You can set the maximum number of incomplete TCP connectionsthe Firebox allows before the SYN flood defense isactivated. The default setting of 60 means that when thenumber of TCP connections waiting to be validated climbsto 61 or above, SYN flood defense is activated. Conversely,when the number of connections waiting for validationdrops to 59 or less, SYN flood defense is deactivated. Youmight need to adjust this setting to custom-fit the SYN Floodprotection feature for your network. Every time the featureself-activates, a log message will be recorded statingSYN Validation: activated. When the feature selfdeactivates,the log message SYN Validation: deactivatedwill be recorded. If these messages occur frequentlywhen your server is not under attack, the MaximumIncomplete Connections setting may be too low. If the SYNFlood protection feature is not preventing attacks from182 WatchGuard Firebox System