How to get around "configure one application-ddos definition for each protected server" in Juniper SRX IDP?

Question

When using an SRX (we have a 1400) to protect a server we can create an application-ddos rule for DNS, but what if we want to protect it against SQL exploit attempts like "SaAdmin" login attempts?

In the JUNOS guide, it states,

"Note: Application-level denial-of-service (application-level DDoS) detection will not work if two rules with different application-level DDoS applications process traffic going to a single destination application server."

It's almost as if you can protect a server from only one protocol's exploits at a time. If that's not the case, how is it done? I haven't seen a single configuration for SRX IDP that shows a specific destination protected for more than a single application/protocol. What happens if you want to protect your webserver from HTTP and FTP exploits?

Answer 1

I would recommend not using AppDDoS moving forward. Juniper announced its deprecation some time ago, and this is probably the reason you can't find many solid examples of its use: http://kb.juniper.net/InfoCenter/index?page=content&id=KB28592&actp=search&viewlocale=en_US&searchid=1374905420170

Ironically, that KB recommends using the DDos Secure Product which has also been canned.

To somewhat reproduce AppDDoS behaviour, you can do the following:

Create a custom-attack referencing the protocol you are specifically hunting (e.g.: SQL), and just pick a context to match a normal operation (e.g.: mssql-login). You can then apply time-binding count 100 to it, which basically means - if you see 100 of these within a minute, this is an attack. The scope variable determines: from a single source to multiple destinations (DoS), from multiple sources to a single destination (DDoS), or just a single a single peer to a single destination.

The whole thing looks like:

custom-attack SQL-DDOS {
    recommended-action drop;
    severity major;
    time-binding {
        count 100;
        scope destination;
    }
    attack-type {
        signature {
            context mssql-login;
            direction client-to-server;
            protocol {
                tcp {
                    destination-port {
                        match equal;
                        value 1433;
                    }
                }
            }
        }
    }
}

Reference your attack(s) in an IPS policy, and make the then term something like:

idp-policy FRONTEND-SERVICS {
   rulebase-ips {
        rule SQL-SERVER {
            match {
                application junos-ms-sql;
                attacks {
                    custom-attacks SQL-DDOS;
                }
            }
            then {
                action {
                    drop-connection;
                }
                ip-action {
                    ip-block;
                    target source-address;
                    log;
                    timeout 60;
                    refresh-timeout;
                }
            }
        }
    }
}

This will put in an ip-block action against any source addresses that trigger this attack for 1 minute, and if any further attacks from the same source are detected (e.g.: it's a dumb bot), keep restarting the 60-second timer every time you see one.