Sophos Firewall - extremely poor bandwidth when DoS enabled

Well, we got a quote from our ISP for them to do DoS for us -- even though we originally went with the Sophos because it boasted DoS capabilities --- $3200 a month they want. Does anyone know if this is normal? That sounds expensive to me. Also, does anyone know what layer of DoS the Sophos provides? I never got a reply on this thread. Additionally, when setting up this Sophos, the person helping deploy it said I should have checked the "Apply Flag" checkboxes under the DESTINATION section, not SOURCE (in my original screenshot of my test DoS settings). Thoughts?

I cannot comment on the pricing, i can only reference to the points, i already made in other subjects. DDOS attackes, which are caused by "Load" are hard to protect on a device level. 

So if the provider is giving you a actual prevention of "to many packets will arrive your interface" thats a true DDOS prevention. Because the provider is the only part in this segment, which actually can deal with dynamic routing and multiple backend systems such attacks. 

If a attack launches multiple zombies to flood your interface, the firewall cannot stop this at all. 

So no matter what you do on the firewall level, a true attack on you as a company in case of "load" is not be able to stop on a firewall protect. It will overload the interface stack, which cannot deal with this at all. See bigger companies getting floaded by DDOS. 

The question is: Did you already receive such a attack? What was the impact and the lost of your company. Did you had a recovery plan for this? (Second WAN to offload to other WAN ports etc.). 

I would recommend to check your options and how likely such a attack is to happen and what this will eventually cost, if you WAN is down for 1 hour, 8 hours etc. Because likely bot nets are not there "forever". So a DDOS Attack will not occur for weeks. 

And as a last part: SD-WAN in SFOS will be improved by latency and other techniques, which could actually see such attacks to happen on your main WAN Port and automatically failover to other WAN ports, which are not publicly known. So if you have a cheap backup WAN, which does not offer services, likely, this WAN interface is not known for the attack and could be used while they flood your primary interface. 

I cannot comment on the pricing, i can only reference to the points, i already made in other subjects. DDOS attackes, which are caused by "Load" are hard to protect on a device level. 

So if the provider is giving you a actual prevention of "to many packets will arrive your interface" thats a true DDOS prevention. Because the provider is the only part in this segment, which actually can deal with dynamic routing and multiple backend systems such attacks. 

If a attack launches multiple zombies to flood your interface, the firewall cannot stop this at all. 

So no matter what you do on the firewall level, a true attack on you as a company in case of "load" is not be able to stop on a firewall protect. It will overload the interface stack, which cannot deal with this at all. See bigger companies getting floaded by DDOS. 

The question is: Did you already receive such a attack? What was the impact and the lost of your company. Did you had a recovery plan for this? (Second WAN to offload to other WAN ports etc.). 

I would recommend to check your options and how likely such a attack is to happen and what this will eventually cost, if you WAN is down for 1 hour, 8 hours etc. Because likely bot nets are not there "forever". So a DDOS Attack will not occur for weeks. 

And as a last part: SD-WAN in SFOS will be improved by latency and other techniques, which could actually see such attacks to happen on your main WAN Port and automatically failover to other WAN ports, which are not publicly known. So if you have a cheap backup WAN, which does not offer services, likely, this WAN interface is not known for the attack and could be used while they flood your primary interface.