You can also use can use request blocking in the DoS profile to specify conditions

for when the system

blocks requests. Note that the system only blocks requests during a DoS attack when
the Operation Mode
Preventing DoS Attacks on Applications
16
for TPS-based or stress-based detection is set to Blocking. You can use request
blocking to rate limit or
block all requests from suspicious IP addresses, suspicious countries, or URLs
suspected of being under
attack. Site-wide rate limiting also blocks requests to web sites suspected of
being under attack. If you
block all requests, the system blocks suspicious IP addresses and geolocations
except those on the
whitelist. If you are using rate limiting, the system blocks some requests
depending on the threshold
detection criteria set in the DoS profile.
The mitigation methods that you select are used in the order they appear on the
screen. The system
enforces the methods only as needed if the previous method was not able to stem the
attack.
About geolocation mitigation
You can mitigate DoS attacks based on geolocation by detecting traffic from
countries sending suspicious
traffic. This is part of the mitigation methods in the DoS profile for stress-based
and TPS-based
anomalies, and this method helps protect against unusual activity as follows:
• Geolocation-based Client Side integrity: If traffic from countries matches the
thresholds configured in
the DoS profile, the system considers those countries suspicious, and sends a
JavaScript challenge to
each suspicious country.
• Geolocation-based CAPTCHA challenge: If traffic from countries matches the
thresholds configured
in the DoS profile, the system considers those countries suspicious, and issues a
CAPTCHA challenge
to each suspicious country.
• Geolocation-based request blocking: The system blocks all, or some, requests from
suspicious
countries.
In addition, you can add countries to a geolocation whitelist (traffic from these
countries is never
blocked) and a blacklist (traffic from these countries is always blocked when a DoS
attack is detected).