Firepower DDOS attack prevention

[doraz]

Hello,

I'm trying to use the firepower, in my ASA 5555-x with firepower services, in order to protect from a DDOS attack.

I encountered the following DDOS attack:

A lot of global IP addresses sent http connections to my inside web server. The firepower allowed all traffic and my web server crashed.

I tried to enable rate-based attack prevention in the Network Analysis Policy without the drop checkbox, just for monitoring, but in the intrusion events I can see a lot of events even from my local network trying to access my web server in the DMZ. It looks like that feature will cause a lot of False-Positive events.

In the rate-based I configured the control simultaneous connection with 350 connections...

What is the best way to gain protection from this kind of attack with the firepower?

BR,

Dor.

[Claudiu Cismaru]

First of all, how did you configure the tracking? Based on source or destination?

If you want the local network to not be checked against it, you should create another NAP without rate based preproc enabled and assign it only to your network, though a NAP rule. This way, the local traffic will not be checked.