SonicOS 7.0 Objects

Download PDF
Technical Documentation > SonicOS 7.0 Objects > DoS Action Profile > Adding DoS Action Profiles > Flood Protection > Layer 2 SYN/RST/FIN Flood Protection

Layer 2 SYN/RST/FIN Flood Protection

The SYN/RST/FIN Blacklisting feature lists devices that exceeded the SYN, RST, and FIN Blacklist attack threshold. The firewall drops packets sent from blacklisted devices early in the packet evaluation process, enabling the firewall to handle greater amounts of these packets, providing a defense against attacks originating on local networks while also providing second-tier protection for WAN networks.

Devices cannot occur on the SYN/RST/FIN Blacklist and watchlist simultaneously. With blacklisting enabled, the firewall removes devices exceeding the blacklist threshold from the watchlist and places them on the blacklist. Conversely, when the firewall removes a device from the blacklist, it places it back on the watchlist. Any device whose MAC address has been placed on the blacklist will be removed from it approximately three seconds after the flood emanating from that device has ended.

To configure the Layer 2 SYN/RST/FIN Flood Protection

  1. Navigate to OBJECT | Action Profiles > DoS Action Profile.

  2. Do one of the following:

    • Add a new DoS Action Profile.

      1. Click the Add icon.
      2. Enter a friendly DoS Rule Action Name.

    • Edit an existing DoS Action Profile.

      Hover over an existing DoS Action Profile and click the Edit icon.

  3. Click Flood Protection > Layer 2 SYN/RST/FIN Flood Protection option.

  4. Enable SYN/RST/FIN/TCP flood blacklisting on all interfaces to enable the blacklisting feature on all interfaces on the firewall and change the default settings.

  5. Make the necessary changes to the default settings.

    Never blacklist WAN machines

    To always skip adding WAN systems to the SYN Blacklist.

    This option is recommended as leaving it cleared may interrupt traffic to and from the firewall's WAN ports.
    Always allow SonicWall management traffic

    To skip filtering of the IP traffic from a blacklisted device targeting the firewall's WAN IP addresses.

    This allows management traffic and routing protocols to maintain connectivity through a blacklisted device.
    Threshold for SYN/RST/FIN flood blacklisting

    To specify the maximum number of SYN, RST, FIN, and TCP packets allowed per second.

    The minimum is 10, the maximum is 800000, and the default is 1000.

    This value should be larger than the SYN Proxy threshold value because blacklisting attempts to thwart more vigorous local attacks or severe attacks from a WAN network.
  6. Click Save.
  7. Click Cancel to go back to the DoS Action Profile page or proceed with other configurations.

Was This Article Helpful?

Help us to improve our support portal

Yes! Not Really

Techdocs Article Helpful form

  • Hidden
  • Hidden

Techdocs Article NOT Helpful form

  • Still can't find what you're looking for? Try our knowledge base or ask our community for more help.
  • Hidden
  • Hidden