Which feature would you use to protect clients connected to an SRX Series device from a SYN flood attack?

Juniper SRX Series devices use "screen" options to protect against various network-level attacks, including Denial of Service (DoS) and reconnaissance. The SYN flood screen feature specifically monitors the rate of incoming TCP SYN packets to a security zone. When the rate exceeds a configured threshold, the SRX can engage protective mechanisms like SYN proxying or SYN cookies to validate the client before forwarding the connection to the protected server, thus mitigating the attack and protecting downstream clients.

A. security policy: Security policies permit or deny traffic based on criteria like zones and applications but do not inherently detect or mitigate the behavioral pattern of a flood attack.
B. host inbound traffic: This configuration protects the SRX device's control plane (Routing Engine) from excessive traffic, not the clients or servers connected through the device (transit traffic).
C. application layer gateway (ALG): ALGs inspect and modify application-layer payloads to enable complex protocols through NAT. They do not operate at the TCP session level to prevent SYN floods.

1. Juniper Networks Documentation

"Understanding TCP SYN Flood Attack Protection": This document explicitly states

"A SYN flood attack screen feature detects and prevents SYN flood attacks." It details how the screen option monitors SYN packet rates and uses SYN proxy as a defense mechanism.

URL: https://www.juniper.net/documentation/us/en/software/junos/security-policies/topics/concept/security-screen-tcp-syn-flood-attack-protection-understanding.html

2. Juniper Networks Documentation

"Screen Options": This guide provides an overview of screen options

listing "SYN flood protection" as a key capability applied to security zones to protect internal hosts.

URL: https://www.juniper.net/documentation/us/en/software/junos/security-policies/topics/concept/security-screen-option-overview.html

3. Juniper Networks Documentation

"Understanding Host Inbound Traffic": This source clarifies that host-inbound-traffic settings apply to traffic destined for the device itself

distinguishing it from transit traffic protection.

URL: https://www.juniper.net/documentation/us/en/software/junos/flow-based-forwarding/topics/concept/security-host-inbound-traffic-understanding.html