Re: SYN Cookie Protection Always On

Screen rules :

security {
    log {
        mode event;
        event-rate 1500;
    }
    alg {
        ftp disable;
        msrpc disable;
        sunrpc disable;
        rsh disable;
        sip;
        sql disable;
        talk disable;
        tftp disable;
        pptp disable;
        ike-esp-nat {
            enable;
        }
    }
    flow {
        syn-flood-protection-mode syn-cookie;
        aging {
            early-ageout 20;
            low-watermark 80;
            high-watermark 90;
        }
    }
    screen {
        ids-option IcNetwork {
            icmp {
                flood threshold 1000;
            }
        }
        ids-option untrust-screen {
            icmp {
                ip-sweep threshold 1000000;
                fragment;
                large;
                flood threshold 8000;
                ping-death;
            }
            ip {
                bad-option;
                record-route-option;
                timestamp-option;
                security-option;
                stream-option;
                spoofing;
                source-route-option;
                loose-source-route-option;
                strict-source-route-option;
                unknown-protocol;
                block-frag;
                tear-drop;
            }
            tcp {
                syn-fin;
                fin-no-ack;
                tcp-no-flag;
                syn-frag;
                port-scan threshold 1000000;
                syn-ack-ack-proxy threshold 1;
                syn-flood {
                    alarm-threshold 512;
                    attack-threshold 1500;
                    source-threshold 200;
                    destination-threshold 20000;
                    timeout 10;
                }
                land;
                winnuke;
                tcp-sweep threshold 1000;
            }
            limit-session {
                source-ip-based 200;
                destination-ip-based 10000;
            }
        }
        traceoptions {
            file screen.log;
            flag all;
        }
    }