Link Search Menu Expand Document

Firewall Protection Profiles Template

Use this template to add or modify a protection profile on any appliance with a firewall and map it to a segment and zone of your firewall.

Add a New Profiles

  1. Under the Profiles header, click Add.

    The Firewall Protection Profile dialog box opens.

    img

  2. Enter a name for the profile.

  3. Select or clear any of the Security Settings check boxes.

    NOTE: When asymmetric routing is configured, strict three-way TCP enforcement and deep packet inspection (DPI) validation cannot be performed. To enable these settings, turn off asymmetric routing.

  4. In the DoS Thresholds field, select a preset threshold (Lenient, Moderate, or Strict). To further edit a preset threshold, click the edit icon next to the classification you want to edit.

    Alternatively, click Add custom threshold to define specific threshold values.

  5. (Optional) Add exceptions to the Allowlist or Blocklist fields.

  6. (Optional) Click Show advanced settings and set the following fields:

    Field Description
    Rapid aging Set a threshold value (in seconds) to enforce the tearing down of TCP connections when the period of inactivity matches the configured value (for example, 30s).
    Block duration Enforce dynamic blocking of flows originating from a source for a specified duration (for example, 300s).
    Embryonic timeout Set this value so that the firewall can tear down half-open TCP connections when the timeout value is reached (for example, 30s). While TCP connection goes through the three-way handshake (SYN, ACK, SYN-ACK), an embryonic connection is a half-open connection that produces (for example) a SYN without the other two parts of the handshake. This is a popular form of denial of service (DoS) attack.

Add Profile Mappings

After you create a profile, you can map it to a segment and zone of your firewall to achieve the expected behavior.

To map a profile to a segment:

  1. Click Add under the Profile Mappings header.

  2. Click the box under the Segment field and start typing the segment you want to map to your profile, then click the segment.

  3. Click the box under the Zone field and start typing the zone you want to assign to your profile, then click the zone.

  4. Click the box under the Profile Name field and select the profile you created earlier.

  5. Click Save.


Back to top

© Copyright 2022 Hewlett Packard Enterprise Development LP. The information contained herein is subject to change without notice. The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein. Aruba Networks and the Aruba logo are registered trademarks of Aruba Networks, Inc. Third-party trademarks mentioned are the property of their respective owners. To view the end-user software agreement, go to Aruba EULA.