Link to home
Start Free TrialLog in
Avatar of FireBall
FireBall

asked on

SRX 3600 Dropping Packages

We have an SRX 3600 with one NPC and one SPC we do not know how but when it comes 400.000 syn packages it is getting unaccessible.
Is there any way to resolve it ? or discard an ip automatically if it risk for network
Avatar of harbor235
harbor235
Flag of United States of America image

What are the sources of the traffic? Are you exporting flow data? Is there an upstream router that you control?

400,000 syns total or per second?

harbor235 ;}
Is the traffic originating from inside of the network to outside; or is the firewall getting unaccessible when the traffic is originating from internet.

We can configure some limits using screen options under security zone configuration.

Please provide more details.

Thank you.
Avatar of FireBall
FireBall

ASKER

@harbor235 it gets 800.000 PPS :)  but depending on the catalgos it must solve this :
User generated image

@dpk_wal
traffic is comming from the outside.
we have set up lots of limit when attack starts it directly cut all connection from inside or outside
Do you have S/RTBH capabilities on an upstream router or the SRX? Do you collect flow data to assist identifying  the source(s) of the attack?   If not a packet capture etc ..., you can add source based filters, to drop the traffic. You can also engage your ISP for assistance to drop this traffic once identified.

Small packets at a high PPS will cripple a firewall, the best place to filter would be on your edge router. You need to identify
the traffic, packet capture, filter that logs, etc .....


harbor235 ;}
we are using EX4500 on upstream we watch flow stream and that packets come with ttp protocol number 84

firewall {
    family inet {
        filter Blok {
            interface-specific;
            term 1 {
                from {
                    protocol [ tcp udp ];
                }
                then accept;
            }
            term 2 {
                from {
                    protocol icmp;
                }
                then accept;
            }
            term 3 {
                from {
                    protocol 84;
                }
                then {
                    reject;
                }
            }
            term 500 {
                then accept;
            }
        }
    }
}

Open in new window




we put a block like that but it does not block it also we tryed allow only tcp  / allow only udp etc. but all of them come to the srx.

The bad way is when it arrive to srx all networking is getting down , there must be a way
Your first term is allowing the traffic, put the block for port 84 (is it tcp or udp?) at the top

harbor235 ;}
i have change it later. normally it was term1 block 84 term 2 allow all then we change it to term 1 allow tcp term 2 allow udp term 3 block all it reach the srx again
then we change it to term 1 allow udp term 2 block all reached
then we change it to term 1 allow tcp term 2 block all reached again

we do not know what to do know the only way is discarding but this is not good.

beside this we checked for what if the filter workin with block of icmp , it worked
we can not find what if it is tcp or udp

http://en.wikipedia.org/wiki/List_of_IP_protocol_numbers
How do you know its port 84? must be IP protocol 84, easy block

protocol ip
port 84


harbor235 ;}
It is written on srx and sflow logs does it ip protocol port 84
We block all the ports and protocols expect icmp it locked srx again
The pps must be too much for the SRX to handle, if you can't filter at your edge via a router you need to engage your ISP for assistance. Gather info on teh sources and/or the port and they should be able to help out. Who is your ISP?


Found this from the Miercom testing site, looks like the SRX starts to crap out about 180K conn per sec.

harbor235 ;}
How should we increase the pps count for srx 180K is very very low it makes 60mbit of attack :)
also there is no ip protocol in term list of ex 4500

  <range>              Range of values
  [                    Open a set of values
  ah                   IP Security authentication header
  dstopts              IPv6 destination options
  egp                  Exterior gateway protocol
  esp                  IPSec Encapsulating Security Payload
  fragment             IPv6 fragment header
  gre                  Generic routing encapsulation
  hop-by-hop           IPv6 hop-by-hop options
  icmp                 Internet Control Message Protocol
  icmp6                Internet Control Message Protocol Version 6
  igmp                 Internet Group Management Protocol
  ipip                 IP in IP
  ipv6                 IPv6 in IP
  no-next-header       IPv6 no next header
  ospf                 Open Shortest Path First
  pim                  Protocol Independent Multicast
  routing              IPv6 routing header
  rsvp                 Resource Reservation Protocol
  sctp                 Stream Control Transmission Protocol
  tcp                  Transmission Control Protocol
  udp                  User Datagram Protocol
  vrrp                 Virtual Router Redundancy Protocol

Open in new window

use the protocol range and see if that works;

SRX# show filter test
term 1 {
    from {
        protocol 84;
    then
        discard;
.......


harbor235 ;}
Also, you can use screens to filter out unknown or not widely used IP protocols

"For the most part, there are very few IPv4 protocols used on modern networks. You are most familiar with TCP (Protocol 6), UDP (Protocol 17), and ICMP (Protocol 1), along with others like ESP, AH, GRE, IPIP, and a few others. There are 256 potential IP protocols in all (the IP protocol field is eight bits long), although most of them are either unused or obsolete. In most cases, if you see some traffic on such unknown IP protocols, it is likely malicious activity and should be blocked. The Unknown IP Protocol Screen does just this"

show
ids-option Internet-Screen {
    ip {
        unknown-protocol;

harbor235 ;}
ids is works on srx but it does not work on this much pps so that wont solve it i need to do sth. on ex or need to buy some module for srx
Do you have a router in front of the SRX? Network security should be performed at every level of your infrastructure.
I would enable ip protocol filtering on your edge router or block the specific source IP address from the router.  That way that traffic never hits the firewall only legitimate traffic. Since you have a datacenter capable SRX I assume you have a beefy router as well? Datacenter edge routers should be able to drop this traffic in hardware very efficiently.


harbor235 ;}
We use an EX 4500 behind our isp then it routes some subnets to SRX3600 for protection then it returns to the EX 4500 and goes to vlans all edge switches are Stack connected EX4200 so our network is very enterprise but that makes some times difficulties every machine as 1G unshared line if one of them goes high pps to srx it directly block all traffic that is an other question but when we get high pps packages we need to find a way to block it instead of discard or null route an ip address.
for example now an other attack goes on but it does not make any sense -- 400k pps

User generated image
        2015-04-08 22:37:29.810 209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:29.810      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:29.811      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:29.811      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:29.811      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:29.811      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:29.811      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:29.811      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:29.811      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:29.985      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:29.985      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:29.985      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:29.985      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:29.985      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:29.986      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:29.986      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:29.986      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:29.986      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.175      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.175      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.175      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.175      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.176      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.176      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.176      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.176      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.176      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.342      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.342      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.342      209.237.150.145 185.9.158.40    42815   9987    64      0x10    17      16000
           2015-04-08 22:37:30.342      209.237.150.145 185.9.158.40    42815   9987    64      0x10    17      16000
           2015-04-08 22:37:30.342      209.237.150.145 185.9.158.40    42815   9987    64      0x10    17      16000
           2015-04-08 22:37:30.342      209.237.150.145 185.9.158.40    42815   9987    64      0x10    17      16000
           2015-04-08 22:37:30.343      209.237.150.145 185.9.158.40    42815   9987    64      0x10    17      16000
           2015-04-08 22:37:30.343      209.237.150.145 185.9.158.40    42815   9987    64      0x10    17      16000
           2015-04-08 22:37:30.513      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:30.513      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:30.513      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:30.513      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:30.513      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:30.513      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:30.513      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:30.514      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:30.687      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:30.688      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:30.688      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:30.688      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:30.688      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:30.688      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:30.688      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:30.688      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:30.859      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.860      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.860      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.860      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.860      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.860      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.860      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:30.860      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.035      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.035      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.035      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.035      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.035      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.035      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.035      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.035      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.035      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.233      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.233      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.233      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.233      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.233      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.233      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.234      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.234      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.402      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.402      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.402      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.403      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.403      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.403      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.403      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.403      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.403      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.593      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.593      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.593      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.593      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.593      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.594      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.594      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.594      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.751      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.751      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.751      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.751      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:31.751      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:31.752      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:31.752      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:31.752      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:31.930      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.930      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.930      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.930      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.930      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.931      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.931      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:31.931      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.101      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.101      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.101      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.101      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.101      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.102      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.102      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.102      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.102      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.275      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.276      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.276      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.276      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.276      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.276      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.276      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.276      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.276      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.444      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.444      209.237.150.145 185.9.158.40    42815   9987    64      0x00    17      16000
           2015-04-08 22:37:32.444      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:32.445      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:32.445      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:32.445      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:32.445      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000
           2015-04-08 22:37:32.445      209.237.150.145 185.9.158.40    42815   9987    64      0x02    17      16000

Open in new window

Sounds like your EX4500 terminates the external and internal vlans which is a concern from a network security design perspective. The only thing I can say is that you are receiving allot of unwanted traffic and you need the proper network design to mitigate.

Recommendation:
1) Completely separate external and internal vlans onto separate physical switches, the external switch can be all layer 2 depending on your ISP handoff (long term).
2) The EX4500 is a L3 switch, I would craft stateless edge filters (ACLs) that can assist protecting your infrastructure. Filter ip protocol 84 on the EX4500 on the link connecting to your ISP. along wialso add BOGON filters and anti-spoofing filters.
3) Engage your ISP to assist dropping  the unwanted IP protocol traffic

harbor235 ;}
unfortunately we have 2x10G simetric internet line and we are already isp, we have selling dedicated servers and serving colocation services. So our isps wont help for this because we are isp for lots of places :)
We have ip transit lines and multiple bgps , ip transit is working for clean up the traffic which comes from other countries. In Turkey we use our major isp and we get max. 4-5 G attack from Turkey but that make big sense on pps only.
We need to provide a solution in our datacenter
SOLUTION
Avatar of harbor235
harbor235
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
ASKER CERTIFIED SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thank you so much