Manual Chapter :
Create a New DoS Profile
Applies To:
Show Versions
BIG-IQ Centralized Management
- 7.0.0
Create a New DoS Profile
Creating a new DoS profile to improve application security
A denial of service attack (DoS attack) makes a resource unavailable to its intended users, or obstructs the communication media between the intended users and the site. A DoS profile allows you to define, monitor, and mitigate traffic patterns that threaten application security.
First, you create a new DoS profile that defines general properties of DoS protection.
Once the profile is created, you can configure your profile to detect DoS attacks specific to application security. Application security can define DoS attacks based on either:
- A high volume of incoming traffic (usingTPS-based Detectionsettings)
- Server stress (withBehavioral and Stress-based Detectionsettings)
Create a DoS profile with application security
Before you can create a DoS profile, your
virtual server must include an HTTP profile to use the application security
feature.
You create a new DoS profile for your
objects if you have not yet configured DoS protection, or if the current DoS profiles in
the system do not meet the needs of your application or stand-alone virtual server.
- At the top of the screen, clickMonitoring.
- Go to .This displays all monitored objects.
- ClickCreateand selectDoS Profile.
- In the New DoS Profile screen, add and set the properties as appropriate.
- Specify a uniqueNamefor the DoS profile.
- To add a template that automatically populates the required fields for specific protection aspects of the DoS profile, select and option fromCreate from template.Certain template options have a minimum required BIG-IP device version. Ensure that you are creating a DoS profile for a device that meets these requirements.
- Specify an optionalDescriptionfor the DoS profile.
- Specify thePartitionto which the DoS profile belongs.You can replace the defaultCommonpartition when creating DoS profiles by typing a unique name for a new partition.The partition with that name must already exist on the BIG-IP device. No whitespace is allowed in the partition name.
- If you want to make this policy available to application templates, forApplication Templatesselect theMake available in Application Templatescheck box.
- Specify theThreshold Sensitivityfor the DoS profile.Thresholds for detecting attacks are higher when sensitivity isLow, and lower when sensitivity isHigh.This property is not used with the Application Security protection type.
- In theSource IP Address Whitelistsetting, specify the configuration of the Source IP address white list.This property is not used with the Application Security protection type.
- In theHTTP Whitelistsetting, specify the HTTP whitelist to use.This setting is applied only to BIG-IP devices version 13.0, or later.
- At the left, click , then select theApplication SecurityEnabledcheck box, .When enabled, this protects your web application against DoS attacks. Supply or modify any necessary values in the Properties settings. For information on the configuration process, refer to theConfigure for application securitytopic inF5 BIG-IQ Centralized Management: Securityonsupport.f5.com.
- To configure settings for the detection of DoS attacks based on a high volume of incoming traffic, clickTPS-based Detection.PropertyDescriptionOperation ModeSpecifies how the system reacts when it detects an attack, and can beOff,Transparent, orBlocking. If set toOff, no other properties are shown.Thresholds ModeSpecifies how thresholds are configured.
- To configure each mitigation behavior threshold manually, selectManual.
- To use the system default mitigation threshold settings, selectAutomatic.
Thresholds Modeselection affects which threshold options are available in the other sections on this screen.By Source IPSpecifies the criteria that determine when the system treats the IP address as an attacker, and the mitigation method to be used for the attacking IP address.By Device IDSpecifies the criteria that determine when the system treats the device ID as an attacker, and the mitigation method to be used for the attacking device.By GeolocationSpecifies the criteria that determine when the system treats the geolocation as an attacker, and the mitigation method to be used for the attacking geolocation. The settings exclude blacklisted and whitelisted geolocations.By URLSpecifies the criteria that determine when the system treats the URL as an attacker, and the mitigation method to be used for the attacking URL. Heavy URL Protection can also be enabled, but needs to be configured. Click theClick to configurelink next to the option to do so.Site WideSpecifies the criteria that determine when the system determines an entire website is under attack, and the mitigation method to be used.Prevention DurationSpecifies the time spent in each mitigation step before moving (escalating or de-escalating) to the next mitigation step. - To configure settings for the detection of DoS attacks based on server stress, clickBehavioral and Stress-based Detection.PropertyDescriptionOperation ModeSpecifies how the system reacts when it detects a stress-based attack, and can beOff,TransparentorBlocking. If set toOff, no other properties are shown.Thresholds ModeSpecifies how thresholds are configured.
- To configure each mitigation behavior threshold manually, selectManual.
- To use the system default mitigation threshold settings, selectAutomatic.
Thresholds Modeselection affects which threshold options are available in the other sections on this screen.By Source IPSpecifies the criteria that determine when the system treats the IP address as an attacker, and the mitigation method to be used for the attacking IP address.By Device IDSpecifies the criteria that determine when the system treats the device ID as an attacker, and the mitigation method to be used for the attacking device.By GeolocationSpecifies the criteria that determine when the system treats the geolocation as an attacker, and the mitigation method to be used for the attacking geolocation. The settings exclude blacklisted and whitelisted geolocations.By URLSpecifies the criteria that determine when the system treats the URL as an attacker, and the mitigation method to be used for the attacking URL. Heavy URL Protection can also be enabled, but needs to be configured. Click theClick to configurelink next to the option to do so.Site WideSpecifies the criteria that determine when the system determines an entire website is under attack, and the mitigation method to be used.Behavioral Detection and MitigationSpecifies the mitigation behavior, and when enabled, the selected level of mitigation to use.- For theBad actors behavior detectionsetting, selectEnabledto perform traffic behavior, server capacity learning, and anomaly detection.
- For theRequest signatures detectionsetting, selectEnabledto perform signature detection. SelectUse approved signatures onlyto use only approved signatures.
- For theMitigationsetting, select the type of mitigation to be used. Review the description of each mitigation type to select the best one for your environment,
Prevention DurationSpecifies the time spent in each mitigation step before moving (escalating or de-escalating) to the next mitigation step. - When you are finished, save your work.
The new DoS profile is added to the list of
profiles. At this point, you can add it to any object that requires a DoS profile.
