The feature "Preventing SYN Attack Prevention" which is found under Network Analysis Policy -> Settings -> Rate-Bassed Attack Prevention in FirePOWER Management Center 6.0.1 seems exactly what I'm looking for at first hand. Unfortunatly it's not always doing what the following article is saying:
http://www.cisco.com/c/en/us/td/docs/security/firepower/60/configuration/guide/fpmc-config-guide-v60/Detecting_Specific_Threats.html.
It should block only the malicious Source IP addresses, but it's blocking all Source IP addresses when the treshold is reached multiple time simultaneously.
I used the following test set-up:
- One client Computer
- One Windows Server
The client computer was used to login with wrong credentials on the Windows Server and when it reached the treshold and couldn't establish a connection anymore I switched the IP address of the client. Sometimes I could establish a connection (like it should) and sometimes when I had 2 or 3 IP addresses locked out because of reaching the treshold, the FirePOWER module was blocking all source IP addresses.
Cisco, can you plse explain to me why it's blocking all Source IP addresses?
