Syn-Flood protection

The follow AFM Operations Guide may help:

Denial of Service | BIG-IP AFM operations guide

You can configure TCP SYN flood protection on a virtual server level by applying a DoS profile, or at a device level (globally). Each environment is different so you will need to adjust the threshold settings to suit yours. However, I have provided some examples below (I would strongly recommend testing this in a NON-PRODUCTION environment):

Example TCP SYN Flood Configuration for Virtual Server

create security dos profile DOS dos-network add { DOS { network-attack-vector add { tcp-syn-flood { state mitigate threshold-mode manual rate-threshold 1000 rate-limit 1000 bad-actor enabled per-source-ip-detection-pps 100 per-source-ip-limit-pps 100 } } } }

modify ltm virtual <VS NAME> profiles add { DOS }

 

Example TCP SYN Flood Configuration at Device Level

modify security dos device-config dos-device-config dos-device-vector { tcp-syn-flood { state mitigate threshold-mode manual detection-threshold-pps 10000 detection-threshold-percent infinite default-internal-rate-limit 30000 } }