Having recently had my 5510 taken down in a SYN-flood DDoS, the key thing you need to know is how big the DDoS is going to be.
Our ASA 5510 hit its limit at 140,000 packets per second. Although the specs say 190,000 packets per second, other factors can influence the actual rate achieved. The 5505 can handle fewer packets per second than the 5510. Higher models can handle more.
We may have had the resources at the back end to handle that many connections, but since the firewall was the bottleneck, we never got to find out.
There are other types of DDoS and other bottlenecks you can run into. Some of them involve lots of bandwidth and fewer packets. Some specifically target inbound or outbound bandwidth. Some make relatively few requests but since they are attacking your application rather than your network, a few requests is enough.
If you plan on identifying the IP addresses and blocking them at your firewall you will want a few things in place before the DDoS hits:
- Out of band access. If they knock out your network, you can't SSH or RDP in. Make sure you have another way in. This may include a second internal network as the attack may have taken down the internal network.
- Analysis tools. Splunk and Graylog are two options with free versions. Good SIEM tools are usually expensive but more suited to the task. Your goal here is to verify that it is actually a deliberate DDoS and find the pattern that allows you to extract the IP addresses. Make sure all your logs are already in these tools and you are familiar with using them.
- Scriptable firewall updates. Botnets can be large. SYN-floods can have spoofed IP addresses. We saw over 100,000 uniques in a ten minute period. You will want a script that can take a list of IP addresses and add them all to the firewall. You will also want these in tables to avoid the firewall having to scan through all 100,000 entries before allowing or denying a packet.
- Out-of-band Public Relations. Have an official Twitter account or Facebook page or mailing list (with no reliance on your main network) that your customers subscribe to so you can let them know why you're down.
- A backup plan. If your guesses about what you might need are wrong or if you just can't find the pattern, there are DDoS protection services available that can take over... for a price. Make sure you know which one of these you would choose and you know how to hand control over to them. You will also want to evaluate the cost of downtime vs. the cost of paying for the protection. Depending on your business, it may be better just to accept the downtime.