Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In our office we're running a Cisco ASA 5510 firewall. Is this device enough if we want to protect against DDoS attacks?

What devices (like cisco guard, etc) do you recommend and what's the user experience that you have with those devices?

Regards,

share|improve this question

2 Answers 2

up vote 1 down vote accepted

That depends on how sophisticated the DDoS is and how large your pipe to the internet is. That device is probably not going to give you any real protection to a true DDoS attack and you won't find a device that will. The main way to survive a DDoS is to get behind someone who filters the internet traffic coming to you and who has a massive amount of bandwidth. Companies like Akamai offer such services.

share|improve this answer
    
What about Cisco Guard? they claim to give a DDoS protection –  Andre Feb 21 '11 at 14:36
    
@Andre That is why I said it depends on how large your connection to the internet is. Unless you have a deal with your internet provider the DDoS traffic is still going to come over your connection to the Cisco box. If the DDoS is exploiting a slow part of your system then the box will help, if it is just filling your internet connection with too much traffic it won't help. Most real DDoS attacks these days use bot farms that just fill your pipe with traffic. –  carson Feb 21 '11 at 15:39
    
What do you recommend for a "basic" level of protection? –  Andre Feb 21 '11 at 20:07

Anti-DDoS hardware helps. But if the attack is large enough it will take down neighboring routers. When Microsoft was having trouble keeping their site up, they used Akamai.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.