These claims depend on the level of attack. Firewalls do have features, for instance, they can proxy a tcp-syn connection and not send it to the server if it doesn't get an ack. If the firewall can sustain the attack, and the server doesn't have syn-cookies, this would be a mitigation of a ddos by the firewall. Also they obviously block traffic, which is a security benefit.
Also, what if the attack has spoofed source addresses, and is evasive of profiling. In other words, what are you going to null route. The ingress path of the attack packets would have to be traced and cut off at the border of upstream providers, killing legit traffic as well. While the real sources are hunted down, this would be the effort to mitigate the attack. An advanced firewall or load balancer (that multiplex's the connections) would be able to mitigate this attack. So to me, it doesn't look like a one thing fits solution. -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Roland Dobbins Sent: Monday, June 29, 2009 10:17 AM To: Cisco-nsp Subject: Re: [c-nsp] DNS rewrite & global capabilities On Jun 29, 2009, at 8:33 PM, Jonathan Brashear wrote: > t seems like the ability to rewrite DNS against certain DDoS attacks Marketing claims aside, firewalls have no utility whatsoever in terms of defending against DDoS attacks, and actually tend to make the situation worse and the server behind them *more* vulnerable to DDoS, and not less, due to the limitations of the stateful capacity they embody. You'd be far better off using S/RTBH as a reaction tool, and depending upon your application and its importance/scale, may wish to investigate other tools intended to protect firewalls and the things behind them from DDoS (full disclosure; I work for a company which makes such tools). But even more than that, putting your public-facing DNS (or any other kind of server) behind a firewall is a very serious architectural mistake; firewalls in front of public-facing servers provide no security value whatsoever, and degrade the overall security posture due to the issues denoted above. Far, far better to bring your public- facing DNS servers out from behind the firewall, employ all the various host- and application-/service-specific BCPs, ensure your DNS architecture is properly designed and scaled, and make use of S/RTBH, et. al. to deal with DDoS. ----------------------------------------------------------------------- Roland Dobbins <[email protected]> // <http://www.arbornetworks.com> Unfortunately, inefficiency scales really well. -- Kevin Lawton _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
