Firewall Protection Profiles Template

Use this template to add or modify a protection profile on any appliance with a firewall and map it to a segment and zone of your firewall.

Add New Profiles

1. Under the Profiles header, click Add.

   The Firewall Protection Profile dialog box opens.

   

2. Enter a name for the profile.

3. Select or clear any of the Security Settings check boxes.

   NOTE: When asymmetric routing is configured, strict three-way TCP enforcement and deep packet inspection (DPI) validation cannot be performed. To enable these settings, turn off asymmetric routing.

4. In the DoS Thresholds field, select a preset threshold (Lenient, Moderate, or Strict). To further edit a preset threshold, click the edit icon next to the classification you want to edit.

   Alternatively, click Add custom threshold to define specific threshold values.

5. (Optional) Add exceptions to the Allowlist or Blocklist fields.

6. (Optional) Click Show advanced settings and set the following fields:

   Field	Description
   Rapid aging	Set a threshold value (in seconds) to enforce the tearing down of TCP connections when the period of inactivity matches the configured value (for example, 30s).
   Block duration	Enforce dynamic blocking of flows originating from a source for a specified duration (for example, 300s).
   Embryonic timeout	Set this value so that the firewall can tear down half-open TCP connections when the timeout value is reached (for example, 30s). While TCP connection goes through the three-way handshake (SYN, ACK, SYN-ACK), an embryonic connection is a half-open connection that produces (for example) a SYN without the other two parts of the handshake. This is a popular form of denial of service (DoS) attack.

Add Profile Mappings

After you create a profile, you can map it to a segment and zone of your firewall to achieve the expected behavior.

To map a profile to a segment:

1. Click Add under the Profile Mappings header.

2. Click the box under the Segment field and start typing the segment you want to map to your profile, then click the segment.

3. Click the box under the Zone field and start typing the zone you want to assign to your profile, then click the zone.

4. Click the box under the Profile Name field and select the profile you created earlier.

5. Click Save.

---