Rate Limiting for DoS Mitigation

Introduction

Rate Limiting is a defense against DoS (Denial of Service) attacks.

Rate Limiting rules allow to limit traffic coming from specified sources, or sent to specified destination and using specific services.

Rate limiting is enforced by SecureXL Check Point product on a Security Gateway that accelerates IPv4 and IPv6 traffic that passes through a Security Gateway. on these:

Bandwidth and packet rate
Number of concurrent connections
Connection rate

For additional information, see sk112454.

Use these commands to configure Rate Limiting for DoS Mitigation:

Command in Gaia gClish

Command in the Expert mode

Comment

fw sam_policy

fw6 sam_policy

g_fw sam_policy

g_fw6 sam_policy

See fw sam_policy.

You must use this parameter:

quota <Quota Filter Arguments>

fwaccel dos config

fwaccel6 dos config

g_fwaccel dos config

g_fwaccel6 dos config

See fwaccel dos config.

Monitoring Events Related to DoS Mitigation

To see some information related to DoS Mitigation, run these commands:

Command in Gaia gClish

Command in the Expert mode

Instructions

fwaccel stats

fwaccel6 stats

g_fwaccel stats

g_fwaccel6 stats

Shows all SecureXL statistics (for IPv4 and IPv6 kernel modules).

See:

fwaccel stats -d

fwaccel6 stats -d

g_fwaccel stats -d

cat /proc/ppk/drop_statistics

g_fwaccel6 stats -d

cat /proc/ppk6/drop_statistics

Shows SecureXL drop statistics only (for IPv4 and IPv6 kernel modules).

See:

fw samp get -l |\ grep '^<[0-9a-f,]*>$' |\ xargs fwaccel dos rate get

fw samp get -l |\ grep '^<[0-9a-f,]*>$' | xargs fwaccel6 dos rate get

g_fw samp get -l |\ grep '^<[0-9a-f,]*>$' |\ xargs fwaccel dos rate get

g_fw samp get -l |\ grep '^<[0-9a-f,]*>$' | xargs fwaccel6 dos rate get

Shows details of active policy rules in long format (for IPv4 and IPv6 kernel modules).

See fw sam_policy get.

N / A

cat /proc/ppk/rlc

Shows:

Total drop packets
Total drop bytes

See The /proc/ppk/ and /proc/ppk6/ entries.

In addition, see SecureXL Debug.