Solved

securing router from DOS attack on ASA Firewall

Posted on 2009-07-09
6
813 Views
Last Modified: 2012-05-07
I have an ASA firewall that has an inside network and an outside interface that is connected to the internet ... I've some ports opened on the PIX firewall that are for the clients from the internet to access our certain DMZ servers ... rest, everything is blocked ... now when DOS attack occurs, the attacker on the Internet is gonna utilize my existing open ports through whatever utility, say for instance NMAP or PF. They're gonna flood those opened port with attacks at speed of 100 mbps .... Now, my question is this that is there a threshold level I can define (and from memory if i can rememeber, it used to be done through the static command on ASA but I've really forgotten how) that I can tell my ASA to accept a specific number of connections .... and beyond that dont accept any connections ?
Can someone please give me the command for it and its impact on live network ?
0
Comment
Question by:nabeel92
  • 3
  • 2
6 Comments
 
LVL 9

Expert Comment

by:jfer0x01
Comment Utility
Hi,

DOS attacks arent focused on how many ports you have open, but to ip address in you own publicly

what you may want to research for DOS Mitigation is to be able to drop connection from the DOS source, after x amount of connection attempts

I have not done this on a Cisco, but is this what you are interested in?

Jfer

0
 

Author Comment

by:nabeel92
Comment Utility
Thanks for the post.

but to ip address in you own publicly >> Sorry, I really didnt understand what you meant by this.

what you may want to research for DOS Mitigation is to be able to drop connection from the DOS source, after x amount of connection attempts >> Yes, thats exactly what am looking for on Cisco ASA. Infact, leave a particular source aside, I know my server on DMZ doesn't have more than 400 connections open at an instant. So if I can specify any source, then maybe i can prevent against a DDOS attack as well.
0
 
LVL 8

Expert Comment

by:pgolding00
Comment Utility
try this -
http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/s8.html#wp1505226
look at the max_conns and emb_lim parameters, max is the total working sessions and emb is the max number of conns in half open state, which often happens under attack conditions.
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 9

Expert Comment

by:jfer0x01
Comment Utility
Yes,

DOS and DDOS attacks target ip addresses, not ports, it does not matter what port is used, even if it blocked or dropped, the number of requests are processed regardless

use tcp max_conns and udp max_conns in your acl rules to the interfaces desired

but remember,

any DOS attack, especially a DDOS, can take you down, regardless of any drop rules you have

It's all a matter of, who has the greater bandwidth and who has the greater computation power in the network devices used

0
 

Author Comment

by:nabeel92
Comment Utility
are you able to give me an exact command ?

access-list 1 line 16 extended permit udp any host 203.38.242.114 eq 4569

secondly, if we do that thru ACL, then how does that differ from the max-connections we use at the end of static command ... coz its the static command thru which we're basically allowing the conncetions from outside to the network .... Am just trying to understand the concept that how the ACL max_conn differs from static max_conns commands ...

If anybody can be kind enough to give me the commands, it will be much appreciated !
0
 
LVL 9

Accepted Solution

by:
jfer0x01 earned 500 total points
Comment Utility
ok,

a DOS makes and establishes various connect requests in order to function

all you are trying to do is limit the amount of connections, any one foreign ip address can make per given time

This could conflict with peer-2-peer apps

taken from

http://www.cisco-tips.com/configuring-connection-limits-on-cisco-asa-firewalls-protect-from-dos/

STEP1: Identify the traffic to apply connection limits using a class map

ASA(config)# access list CONNS-ACL extended permit ip any 10.1.1.1 255.255.255.255
ASA(config)# class-map CONNS-MAP
ASA(config-cmap)# match access-list CONNS-ACL

STEP2: Add a policy map to set the actions to take on the class map traffic

ASA(config)# policy-map CONNS-POLICY
ASA(config-pmap)# class CONNS-MAP
! The following sets connection number limits
ASA(config-pmap-c)# set connection {[conn-max n] [embryonic-conn-max n]
[per-client-embryonic-max n] [per-client-max n] [random-sequence-number {enable | disable}]}

where the conn-max n argument sets the maximum number of simultaneous TCP and/or UDP connections that are allowed, between 0 and 65535.

The embryonic-conn-max n argument sets the maximum number of simultaneous embryonic connections allowed, between 0 and 65535.

The per-client-embryonic-max n argument sets the maximum number of simultaneous embryonic connections allowed per client, between 0 and 65535.

The per-client-max n argument sets the maximum number of simultaneous connections allowed per client, between 0 and 65535.

! The following sets connection timeouts
ASA(config-pmap-c)# set connection timeout {[embryonic hh:mm:ss] {tcp hh:mm:ss
[reset]] [half-closed hh:mm:ss] [dcd hh:mm:ss [max_retries]]}

STEP3: Apply the Policy on one or more interfaces or Globaly

ASA(config)# service-policy CONNS-POLICY {global | interface interface_name}


Hope this helps

Jfer
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Suggested Solutions

Hi All,  Recently I have installed and configured a Sonicwall NS220 in the network as a firewall and Internet access gateway. All was working fine until users started reporting that they cannot use the Cisco VPN client to connect to the customer'…
Creating an OSPF network that automatically (dynamically) reroutes network traffic over other connections to prevent network downtime.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now