Configuring The Attack Protection - Cisco ISA500 Series Administration Manual

Firewall

Configuring the Attack Protection

STEP 4
STEP 5
Configuring the Attack Protection
STEP 1
STEP 2
STEP 3
Cisco ISA500 Series Integrated Security Appliance Administrator Guide
• IP Address: Choose an existing IP address object that you want to bind with
the selected MAC address. If the IP address object you want is not in the list,
choose Create an IP Address to add a new IP address object. To maintain
the IP address objects, go to the Networking -> Address Object
Management page. See
• Log Dropped Packets: Choose Enable to log all packets that are dropped.
Otherwise, choose Disable.
Click OK to save your settings.
Click Save to save your settings.
Use the Attack Protection page to specify how to protect your network against
common types of attacks including discovery, flooding, and echo storms.
Click Firewall -> Attack Protection.
The Attack Protection window opens.
In the WAN Security Checks area, enter the following information:
• Block Ping to WAN interface: Check the box to prevent attackers from
discovering your network through ICMP Echo (ping) requests. We
recommend that you disable this feature only if you need to allow the
security appliance to respond to pings for diagnostic purposes.
• Enable Stealth Mode: Check the box to prevent the security appliance from
responding to incoming connection requests from the WAN. In Stealth Mode,
your security appliance does not respond to blocked inbound connection
requests, and your network is less susceptible to discovery and attacks.
• Block TCP Flood: Check this box to drop all invalid TCP packets. This feature
protects your network from a SYN flood attack, in which an attacker sends a
succession of SYN (synchronize) requests to a target system. It blocks all
TCP SYN flood attackes (200 packets per seconds) from the WAN
interfaces.
In the LAN Security Checks section, enter the following information:
Address Management, page
6
152.
207