I see a new entry in DoS protection called "IP Flood"

Question

Sophos v20 GA 
 I have never noticed this IP Flood protection before. It is not applied, but I cannot see it's activation anywhere in the GUI. 
 All I see activatable is SYN, UDP, TCP and ICMP, Dropped source routed packets, Disable ICMP/ICMPv6 redirect packet, and ARP hardening

sanket.shah · Accepted Answer

Hello, 
 "IP Flood" is not a new feature and it's there since many releases (at least since v17.0+ like mentioned above). 
 It was given in CLI along with DoS bypass rule CLI but never make it to GUI due to other priorities and that could be the reason it might not have been observed by many admins. 
 Admin may want to use "IP flood" in a scenario where they would like to block all IP traffic regardless of whether it's TCP or UDP (which is given in GUI). Configuration part is in CLI and on GUI, drop counters can be seen.

Vishal_R · Answer

Hi rfcat_vk & alan weir I have worked with the Documentation team and the help section details are now updated regarding option "IP flood": https://docs.sophos.com/nsg/sophos-firewall/20.0/help/en-us/webhelp/onlinehelp/AdministratorHelp/IntrusionPrevention/IPSDoSAttacks/index.html

Vishal_R · Answer

Hi alan weir Thank you for reaching out to the Sophos community team, This details [ "IP Flood" ] in the DoS summary page is expected and it has been there since DoS rules from CLI were implemented long back..! That option is only configurable via the CLI as per the CLI help guide below: 
 https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/CommandLineHelp/DeviceConsole/SystemCommands/index.html#dos-config console> system dos-config show dos-rules If one has configured the same settings via CLI at that time intention is to show those Attackers/Victim IPs in UI for which the dropped packet counts are increased.

Vishal_R · Answer

Hi rfcat_vk In terms of reference, for the IP flood option, I will work with the documentation team to add notes or tool tips. Regarding the previous version query part, this option is always there under the "DoS attacks" page (i.e. the web admin page which loads after clicking on Intrusion prevention ) but not under "DoS settings". Please check this 4-year-old video explaining "Creating & Configuring IPS Policies with V17 and navigate to around 0:43 seconds, you will see that option (IP Flood) in that video as well which indicates that this option has been there for a long..! https://www.youtube.com/watch?v=uyRLYXQ5h90&list=PL_b4O8ZwWOqtLRR3iINNWhXQaQF902AIW&index=8

I see a new entry in DoS protection called "IP Flood"

Top Replies