Juniper SRX Blank Proxy-Identity – Troubleshooting

I solved this problem finally. By capturing and comparing DHCP Discover packets sent from JunOS and Cisco, I found Cisco sends Option 64 Client Identifier and Option 12 Host Name by default. However, JunOS will not send them without explicit instructions.

I think my ISP sets up a filter or something on their side. The above two options are mandatory. When I configure my SRX to send them, everything went through.

I would recommend not using AppDDoS moving forward. Juniper announced its deprecation some time ago, and this is probably the reason you can't find many solid examples of its use: http://kb.juniper.net/InfoCenter/index?page=content&id=KB28592&actp=search&viewlocale=en_US&searchid=1374905420170

Ironically, that KB recommends using the DDos Secure Product which has also been canned.

To somewhat reproduce AppDDoS behaviour, you can do the following:

Create a custom-attack referencing the protocol you are specifically hunting (e.g.: SQL), and just pick a context to match a normal operation (e.g.: mssql-login). You can then apply time-binding count 100 to it, which basically means - if you see 100 of these within a minute, this is an attack. The scope variable determines: from a single source to multiple destinations (DoS), from multiple sources to a single destination (DDoS), or just a single a single peer to a single destination.

The whole thing looks like:

custom-attack SQL-DDOS {
    recommended-action drop;
    severity major;
    time-binding {
        count 100;
        scope destination;
    }
    attack-type {
        signature {
            context mssql-login;
            direction client-to-server;
            protocol {
                tcp {
                    destination-port {
                        match equal;
                        value 1433;
                    }
                }
            }
        }
    }
}

Reference your attack(s) in an IPS policy, and make the then term something like:

idp-policy FRONTEND-SERVICS {
   rulebase-ips {
        rule SQL-SERVER {
            match {
                application junos-ms-sql;
                attacks {
                    custom-attacks SQL-DDOS;
                }
            }
            then {
                action {
                    drop-connection;
                }
                ip-action {
                    ip-block;
                    target source-address;
                    log;
                    timeout 60;
                    refresh-timeout;
                }
            }
        }
    }
}

This will put in an ip-block action against any source addresses that trigger this attack for 1 minute, and if any further attacks from the same source are detected (e.g.: it's a dumb bot), keep restarting the 60-second timer every time you see one.