L7 DDoS Attack Protection Configuration

The L7 DDoS Protection feature in F5 ASM/AWAF is designed to mitigate Layer 7 Distributed Denial of Service (DDoS) attacks, which target the application layer by overloading the web application with requests that appear legitimate. The configuration screen for L7 DDoS protection is divided into five main sections, with criteria based on different methods for detection and response.

---

1. Detection Criteria:

The Detection Criteria section helps define how the system identifies potential DDoS attacks, specifically focusing on latency and transactions per second (TPS).

• Latency + TPS:

  • This method combines latency with transactions per second (TPS) to detect unusual traffic patterns.

• Stress-based Detection:

  • This approach detects stress on the application servers, which could indicate the server is being overwhelmed by traffic typical of a DDoS attack.

• Auto-calculated (F5 Proprietary):

  • F5's proprietary algorithm automatically calculates the thresholds for DDoS detection, ensuring real-time adjustments based on observed traffic patterns.

• Server-side Detection:

  • This focuses on server-side metrics to determine whether the server is under stress or if the traffic rate exceeds the normal threshold.

• Smaller Values:

  • For the Stress-based Detection mechanism, the threshold values for detection should be smaller than the corresponding vectors used in TPS-based Detection. This ensures that stress-based triggers occur before TPS-based detection, allowing for early mitigation.

---

2. Suspicious Criteria:

The Suspicious Criteria focuses on TPS-based detection, which looks for spikes in traffic that could indicate an ongoing attack.

• TPS-based Detection:

  • This detection is primarily based on transactions per second (TPS), which measures the rate of requests sent to the web server. A high TPS rate could suggest a potential DDoS attack.

• Client-side Detection:

  • This method analyzes the traffic from the client-side (e.g., IP address, cookies) to detect abnormal behavior or attack patterns.

• Greater Values:

  • The TPS-based detection criteria should have higher values than those of Stress-based detection to ensure that TPS thresholds trigger only when significant traffic patterns are detected.

---

3. Anomaly Engine Interval Values:

The Anomaly Engine is responsible for analyzing traffic patterns over a period of time to determine if a request is legitimate or part of a potential attack. The interval settings for this engine are critical in setting how often traffic is analyzed and anomalies are detected.

• Interval settings:

  • These settings control how frequently the Anomaly Engine checks for anomalies in the traffic. The interval values help balance real-time monitoring with system performance and resource consumption.

• Important Consideration:

  • The interval values should be carefully configured to ensure that legitimate traffic is not mistakenly flagged while also ensuring that the system can respond to DDoS attacks quickly. F5 generally uses smaller intervals for more frequent checks, providing faster detection of suspicious traffic spikes.

---

Key Recommendations for Configuration:

1. Fine-tuning Detection Criteria:

   • Adjust the latency and TPS-based thresholds based on historical traffic patterns to avoid false positives and ensure timely DDoS detection.

2. Set Realistic Interval Values:

   • The interval values for anomaly detection should strike a balance between detection speed and system performance. Avoid too short an interval that could overload the system with excessive checks, but ensure it is short enough to detect attacks in a timely manner.

3. Monitor Client-Side and Server-Side Metrics:

   • Use both client-side and server-side metrics to ensure comprehensive monitoring. Server-side metrics help detect stress on the web application, while client-side metrics are useful for identifying sources of suspicious traffic.

4. Stress-based Detection:

   • Keep the stress-based detection values smaller than TPS values to ensure early intervention before a traffic spike overwhelms the server.

5. Regularly Review and Adjust Criteria:

   • Regularly review and adjust the detection and suspicious traffic thresholds as your application traffic patterns evolve, ensuring continued DDoS protection efficacy.