Cisco Cisco Firepower Management Center 4000

The Policy Information page appears.

Click 

 in the navigation panel on the left.

The Advanced Settings page appears.

You have two choices, depending on whether 

under Specific Threat Detection 

is enabled:

If the configuration is enabled, click 

.

If the configuration is disabled, click 

, then click 

.

The Rate-Based Attack Prevention page appears. A message at the bottom of the page identifies the 
intrusion policy layer that contains the configuration. See 

for more information.

You have two options:

To prevent incomplete connections intended to flood a host, click 

 under 

.

The SYN Attack Prevention dialog box appears.

To prevent excessive numbers of connections, click 

 under 

.

The Control Simultaneous Connections dialog box appears.

Select how you want to track traffic:

To track all traffic from a specific source or range of sources, select 

 from the 

 

drop-down list and type a single IP address or address block in the 

 field.

To track all traffic to a specific destination or range of destinations, select 

 from the 

 drop-down list and type an IP address or address block in the 

 field.

Note that the system tracks traffic separately for each IP address included in the Network field. Traffic 
from an IP address that exceeds the configured rate results in generated events only for that IP address. 
As an example, you might set a source CIDR block of 

10.1.0.0/16

 for the network setting and configure 

the system to generate events when there are ten simultaneous connections open. If eight connections 
are open from 10.1.4.21 and six from 10.1.5.10, the system does not generate events, because neither 
source has the triggering number of connections open. However, if eleven simultaneous connections are 
open from 10.1.4.21, the system generates events only for the connections from 10.1.4.21.

For information on using CIDR notation and prefix lengths in the FireSIGHT System, see 

.

Indicate the triggering rate for the rate tracking setting:

For SYN attack configuration, indicate the number of SYN packets per number of seconds in the 

 fields.

For simultaneous connection configuration, indicate the number of connections in the 

 field.

To drop packets matching the rate-based attack prevention settings, select 

. 

In the 

 field, indicate the time period after which to stop generating events, and if applicable, 

dropping, for traffic with the matching pattern of SYNs or simultaneous connections.

Timeout values can be integers from 1 to 1,000,000. However, setting a high timeout value may entirely 
block connection to a host in an inline deployment.

Save your policy, continue editing, discard your changes, revert to the default configuration settings in 
the base policy, or exit while leaving your changes in the system cache. See the 

 table for more information.