1. On the Main tab, click Security > DoS Protection > Device Configuration > Properties .
   The DoS Protection Device Configuration screen opens.
2. From the Log Publisher list, select the destination to which the BIG-IP system sends DoS and DDoS logs.
   You can review, create, and update log publishers in System > Logs > Configuration > Log Publishers .
3. Configure the Threshold Sensitivity.
   Select Low, Medium, or High. A lower setting means the automatic threshold algorithm is less sensitive to changes in traffic and CPU usage, but will also trigger fewer false positives.
4. From the Eviction Policy list, select the eviction policy to apply globally.
   Note: The global context requires an eviction policy. If you do not apply a custom eviction policy, the system default policy, default-eviction-policy is applied and selected in this field.
5. For Relearn, click Start Relearning to start relearning auto thresholds.
   Auto thresholds are calculated from the system start. If you have made changes to the system since then, and want the system to adjust automatic DoS thresholds because of these changes, use this option.
6. To specify a system-wide DoS address list containing addresses that do not need to be checked for DoS attacks, type the name of the list in the Whitelist Address List field.
   Note: Available address lists appear on the right side of the screen, in the Shared Objects pane. You can view, edit, and add address lists there.
7. To apply a system-wide rich DoS whitelist, click Add Whitelist, and type the information to define the packets to allow.
   You can define up to eight rich whitelists.
8. At the top of the screen, from Device Configuration, choose Network Security, DNS Security, and SIP Security to configure relevant attack responses per vector.
   The screen displays all the available attack vectors for the given type.
   Note: Network Security vectors are listed in categories to make the list more manageable. Click the + next to a category to expand it.
9. To enable (or disable) auto thresholds for one or more attack types, select the check box next to the vector name or names, and from the Set Threshold button at the bottom of the screen, select Fully-automatic. Select Manual to disable auto thresholds and set properties manually.
   Note: To work accurately, using fully-automatic thresholds requires some amount of historical data on the system gathered through observing normal traffic. Therefore, it is recommended that you not enforce auto thresholds directly after installation.
   Tip: You can select all vectors by clicking the check box at the top of the list. However, some vectors do not support automatic thresholds. Deselect these vectors before you select Fully-automatic to avoid an error.
10. Similarly, to set the state for one or more attack types, select the check box next to the vector name or names, and from the Set State list at the bottom of the screen, select Mitigate, Detect Only, or Disable.
    The state you click is set for all selected vectors.
11. In the Attack Type column, click the name of any attack type to edit the settings.
    The attack settings appear on the right, in the Properties pane.
12. To enforce the DoS vector, make sure the State is set to Mitigate (watch, learn, alert, and mitigate) .
    Other options allow you to Detect Only (watch, learn, and alert) or Learn Only (collect stats, no mitigation),
    CAUTION:

    For most DoS vectors, you want to enforce the vector, which is the default setting. Set a vector to Disabled (no stat collection, no mitigation) only when you find that enforcement of the vector is disrupting legitimate traffic. For example, if you test a legitimate packet with the packet tester and find a DoS vector is preventing packet transmission, you can adjust the thresholds or disable the vector to remedy the issue.
13. Set the Threshold Mode for the vector.
    • If the attack allows automatic threshold configuration, you can select Fully Automatic or Manual Detection/Auto Mitigation to configure automatic or partially automatic thresholds.
    • To configure thresholds manually, click Fully Manual.
14. Adjust the other settings for the DoS vector for fully automatic, partially maual, or fully manual threshold configuration.
15. Click the Update button.
    The selected configuration is updated, and the changes appear on the Device Configuration screen.
16. Repeat the previous steps for any other attack types for which you want to change the configuration.

1. On the Main tab, click Security > DoS Protection > Device Configuration > Properties .
   The DoS Protection Device Configuration screen opens.
2. From the Log Publisher list, select the destination to which the BIG-IP system sends DoS and DDoS logs.
   You can review, create, and update log publishers in System > Logs > Configuration > Log Publishers .
3. Configure the Threshold Sensitivity.
   Select Low, Medium, or High. A lower setting means the automatic threshold algorithm is less sensitive to changes in traffic and CPU usage, but will also trigger fewer false positives.
4. From the Eviction Policy list, select the eviction policy to apply globally.
   Note: The global context requires an eviction policy. If you do not apply a custom eviction policy, the system default policy, default-eviction-policy is applied and selected in this field.
5. For Relearn, click Start Relearning to start relearning auto thresholds.
   Auto thresholds are calculated from the system start. If you have made changes to the system since then, and want the system to adjust automatic DoS thresholds because of these changes, use this option.
6. To specify a system-wide DoS address list containing addresses that do not need to be checked for DoS attacks, type the name of the list in the Whitelist Address List field.
   Note: Available address lists appear on the right side of the screen, in the Shared Objects pane. You can view, edit, and add address lists there.
7. To apply a system-wide rich DoS whitelist, click Add Whitelist, and type the information to define the packets to allow.
   You can define up to eight rich whitelists.
8. At the top of the screen, from Device Configuration, choose Network Security, DNS Security, and SIP Security to configure relevant attack responses per vector.
   The screen displays all the available attack vectors for the given type.
   Note: Network Security vectors are listed in categories to make the list more manageable. Click the + next to a category to expand it.
9. To enable auto thresholds for one or more attack types, select the check box next to the vector name or names, and from the Set Threshold button at the bottom of the screen, select Fully-automatic.
   Note: To work accurately, using fully-automatic thresholds requires some amount of historical data on the system gathered through observing normal traffic. Therefore, it is recommended that you not enforce auto thresholds directly after installation.
   Tip: You can select all vectors by clicking the check box at the top of the list. However, some vectors do not support automatic thresholds. Deselect these vectors before you select Fully-automatic to avoid an error.
10. In the Attack Type column, click the name of any attack type to edit the settings.
    The attack settings appear on the right, in the Properties pane.
11. To enforce the DoS vector, make sure the State is set to Mitigate (watch, learn, alert, and mitigate) .
    Other options allow you to Detect Only (watch, learn, and alert) or Learn Only (collect stats, no mitigation),
    CAUTION:

    For most DoS vectors, you want to enforce the vector, which is the default setting. Set a vector to Disabled (no stat collection, no mitigation) only when you find that enforcement of the vector is disrupting legitimate traffic. For example, if you test a legitimate packet with the packet tester and find a DoS vector is preventing packet transmission, you can adjust the thresholds or disable the vector to remedy the issue.
12. For Threshold Mode, select Fully Automatic.
    Note: You cannot configure automatic thresholds for every DoS vector. In particular, for error packets you can manually specify only Detection Threshold EPS, Detection Threshold Percent, and the Mitigation Threshold EPS.
    Note: If automatic thresholds are available, you can configure automatic thresholds, partially manual, or manual thresholds for that DoS vector. When you select one configuration setting, the options for the other setting no longer appear.
13. In the Attack Floor EPS field, specify the number of events per second of the vector type to allow at a minimum, before automatically calculated thresholds are determined.

    Because automatic thresholds take time to be reliably established, this setting defines the minimum packets allowed before automatic thresholds are calculated.

14. In the Attack Ceiling EPS field, specify the absolute maximum allowable for events of this type, before automatically calculated thresholds are determined.
    Because automatic thresholds take time to be reliably established, this setting rate limits packets to the events per second setting, when specified. To set no hard limit, set this to Infinite.
15. If the vector includes other settings, such as Bad Actor Detection and Attacked Destination Detection, configure them as needed. If using automatic blacklisting with Bad Actor Detection, be sure to assign a global IP intelligence policy to the device ( Security > Network Firewall > IP Intelligence > Policies ).
16. Click the Update button.
    The selected vector is updated, and the DoS Protection Device Configuration screen refreshes.
17. Repeat the previous steps for any other attack types for which you want to change the configuration.

1. On the Main tab, click Security > DoS Protection > Device Configuration > Properties .
   The DoS Protection: Device Configuration Properties screen opens.
2. At the top of the screen, from Device Configuration, choose Network Security, DNS Security, and SIP Security to configure relevant attack responses per vector.
   The screen displays all the available attack vectors for the given type.
   Note: Network Security vectors are listed in categories to make the list more manageable. Click the + next to a category to expand it.
3. In the Attack Type column, click the name of any attack type to edit the settings.
   The attack settings appear on the right, in the Properties pane.
4. For Threshold Mode, select Fully Manual.
5. From the Detection Threshold EPS list, select Specify or Infinite.
   • Use Specify to set a value (in events per second) for the attack detection threshold. If packets of the specified types cross the threshold, an attack is logged and reported. The system continues to check every second, and registers an attack as long as the threshold is exceeded.
   • Use Infinite to set no value for the threshold. This specifies that this type of attack is not logged or reported based on this threshold.
6. From the Detection Threshold Percent list, select Specify or Infinite.
   • Use Specify to set a value (in percentage of traffic) for the attack detection threshold. If packets of the specified types cross the percentage threshold, an attack is logged and reported. The system continues to check every second, and registers an attack as long as the threshold is exceeded.
   • Use Infinite to set no value for the threshold. This specifies that this type of attack is not logged or reported based on this threshold.
7. From the Mitigation Threshold EPS list, select Specify or Infinite.
   • Use Specify to set a value (in events per second), which cannot be exceeded. If the number of events of this type exceeds the threshold, excess events are dropped until the rate no longer exceeds the threshold.
   • Use Infinite to set no value for the threshold. This specifies that this type of attack is not rate-limited.
8. To log traffic that the system identifies as a DoS attack according to the automatic thresholds, enable Simulate Auto Threshold.
   Note: This setting applies only to vectors that can be configured for automatic thresholds. It allows you to see the results of automatic thresholds on the selected DoS vector without actually affecting traffic. When you enable this setting, the current system-computed thresholds for automatic thresholds are displayed for this vector. Automatic thresholds are not applied to packets unless the Threshold Mode is changed for the vector.
9. To detect IP address sources from which possible attacks originate, enable Bad Actor Detection.
   Note: Bad Actor Detection is not available for every vector.
10. In the Per Source IP Detection Threshold EPS field, specify the number of events of this type per second from one IP address that identifies the IP source as a bad actor, for purposes of attack detection and logging.
11. In the Per Source IP Mitigation Threshold EPS field, specify the number of events of this type per second from one IP address, above which rate limiting or leak limiting occurs.
12. To automatically blacklist bad actor IP addresses, select Add Source Address to Category.
    Important: For this to work, you need to assign an IP Intelligence policy to the appropriate context (device, virtual server, or route domain). For the device, assign a global policy: Security > Network Firewall > IP Intelligence > Policies . For the virtual server or route domain, assign the IP Intelligence policy on the Security tab.
13. Specify the Sustained Attack Detection Time, in seconds, after which an IP address is blacklisted.
14. To change the duration for which the address is blacklisted, specify the duration in seconds in the Category Duration Time field. The default duration for an automatically blacklisted item is 4 hours (14400 seconds).
    After this time period, the IP address is removed from the blacklist.
15. To allow IP source blacklist entries to be advertised to edge routers so they will null route their traffic, select Allow External Advertisement.
    Note: To advertise to edge routers, you must configure a Blacklist Publisher and Publisher Profile at Security > Options > External Redirection > Blacklist Publisher .
16. To set thresholds for attacked destinations, select Attacked Destination Detection.
    1. In the Per Destination IP Detection Threshold EPS field, specify the number of events per second that IP source as a bad actor, for purposes of attack detection and logging.
    2. In the Per Destination IP Mitigation Threshold EPS field, specify the number of events per second headed to one IP address, above which rate limiting occurs.
    3. To automatically blacklist bad actor IP addresses, select Add Destination Address to Category.
       For DoS protection, the blacklist category is set to denial_of_service automatically.
    4. Specify the Sustained Attack Detection Time, in seconds, after which an IP address is blacklisted.
    5. To set the duration the destination address remains blacklisted, specify the Category Duration Time in seconds. The default is 900 seconds.
    6. To allow destination IP blacklist entries to be advertised to edge routers so they will null route their traffic, select Allow External Advertisement.
17. Click the Update button.
    The selected configuration is updated, and the DoS Protection Device Configuration screen opens again.
18. Repeat the previous steps for any other attack types for which you want to manually configure thresholds.

You can specify particular auto or manual thresholds, rate increases, rate limits, enforcement, and other parameters for supported device DoS attack types, to more accurately detect, track, and rate limit attacks.