Hey there all the Cisco Jedi.
I'm still learning the ways of the Cisco, and I need a little help asap.
The setup
------------
Here follows the relivan bits of my config:
A lan, (20-something nodes ), and a Cisco 1700 ( 1721 ) with a ser0, a fa0 and a bri0 ( lets forget abt the bri for now ). On the serial there is a p2p line to our ISP.
The ISP gave me a block of IPz ( abt 50 ) and even though it's not ideal ( as the syptoms indicate ) the network is "walled" by having NAT on the router. Appart from the one or two static mappings the rest is all pool-inside pool-outside. It keeps the worms and koderkidzies out.
The syptom
---------------
Something funny happening here on the p2p internet line. Things time out ... allot ... more and more often. A ping to the router on the other side of the line ( isp side ) shows a pattern, 15 min "good" pinging ( 40 ms to 400 ms ) and then 5 min "BAD" responce ( 1000 to 10 000 ms !! and more ! ) this pattern loops over and over
*note : times not exactly, guistimates .... observations ...actual times vary and the problem sequince is not an exact loop.
The Investigation
--------------------
IP Accounting on the ISP router ( how do I set that up ? ) shows that some IP is sending mass packets every now and then. My router takes one look and sends them back. The ISP router figures these are due for us and sends them back .... 16 times the packets get passed over the p2p bottleneck before they drop.
This is asking for trouble ... I am set up for ultimate DNS attack ! those 16 bounces gives a amplification factor of 16 times to any "unwanted" data coming over the p2p
The question :
----------------
Please enlighten me, the untrained yet eager student, how should I configure this ? Obviously I want to drop bad trafic before it bounces away my bandwith. Is there a better way of using a router as a bit of a hardwear-firewall ? I could ask my ISP to bolck the "attacker" at point where the trafic enters our continent, but this is far from a solution, my setup neads to be geared to handle this situation.
Is it even possible to efectively use my router as a good firewall ?
Many thanks
**Note : Do not sugest buying anything, not even "second hand", out here in africa pre-owned is rarely for sale and all I have is time.
