asked on

how to block ddos a webserver on pix 501

Hi,

I have a webserer on internal LAN of PIX 501. The PIX forward port 80 to this webserver, but recently, I have my friend ran a DDOS to my webserver and it die after 3 second. I though PIX 501 already configure for this purpouse, but it's not.

Can anyone show me how to enable this ddos on PIX 501?

Thanks.

paul1gilbert

By ddos you mean Distributed Denial of Service?

Remember that the pix is a security device. If you are doing this and after a few minutes it times out then it means that the pix is sensing an attack and droping the traffic.
Please let me know if this clears your questions

arron9112003

ASKER

Yes, it's Distribute Denial of Service test.

Doesn't look like it do what you say, it forward all packages to my internal webserver and webserver become overload then httpd just halted. I'm looking for a solution to put a rule on pix501 device to do prevention of ddos attatch.

There should be command lines to create this rule for the pix, but I'm not a big fan of CISCO so I don't have any idea how ;-)
I hope some one can give me a hint on this.

Regards,
Aron.

arron9112003

ASKER

I want the PIX able to block access on which ever IPADDRESS that send DDOS attatch. Can it be done?

arron9112003

ASKER

I don't want it blocks access on normal users access the webserver(port 80), just block DDOS IP.

arron9112003

ASKER

I found this, and it does what I want http://www.linuxsecurity.com/content/view/121960/49/

ASKER CERTIFIED SOLUTION

Jaedub

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

arron9112003

ASKER

Jaedub,

Actualy, I have this set up:

static (inside,outside) tcp interface www 192.168.2.22 www netmask 255.255.255.255 250 150

This is more specific to port 80.
Thanks for your explain.

case close.