Hello,
I'm trying to use the firepower, in my ASA 5555-x with firepower services, in order to protect from a DDOS attack.
I encountered the following DDOS attack:
A lot of global IP addresses sent http connections to my inside web server. The firepower allowed all traffic and my web server crashed.
I tried to enable rate-based attack prevention in the Network Analysis Policy without the drop checkbox, just for monitoring, but in the intrusion events I can see a lot of events even from my local network trying to access my web server in the DMZ. It looks like that feature will cause a lot of False-Positive events.
In the rate-based I configured the control simultaneous connection with 350 connections...
What is the best way to gain protection from this kind of attack with the firepower?
BR,
Dor.