Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 311)

19-3

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 19 Intercepting and Responding to Network Attacks

Protecting Your Network Against Specific Attacks

Step 4 To activate the policy map globally, enter the following command:

hostname(config)# service-policy pmap global

Step 5 To show the TCP map statistics, enter the following command:

hostname# show service-policy set connection

Protecting Your Network Against Specific Attacks

This section describes how to configure protection from certain attacks. This section includes the

following topics:

• Preventing IP Spoofing, page 19-3

• Configuring Connection Limits and Timeouts, page 19-4

• Configuring the Fragment Size, page 19-5

• Blocking Unwanted Connections, page 19-5

Preventing IP Spoofing

This section lets you enable Unicast Reverse Path Forwarding on an interface. Unicast RPF guards

against IP spoofing (a packet uses an incorrect source IP address to obscure its true source) by ensuring

that all packets have a source IP address that matches the correct source interface according to the

routing table.

Normally, the security appliance only looks at the destination address when determining where to

forward the packet. Unicast RPF instructs the security appliance to also look at the source address; this

is why it is called Reverse Path Forwarding. For any traffic that you want to allow through the security

appliance, the security appliance routing table must include a route back to the source address. See

RFC 2267 for more information.

For outside traffic, for example, the security appliance can use the default route to satisfy the

Unicast RPF protection. If traffic enters from an outside interface, and the source address is not known

to the routing table, the security appliance uses the default route to correctly identify the outside

interface as the source interface.

If traffic enters the outside interface from an address that is known to the routing table, but is associated

with the inside interface, then the security appliance drops the packet. Similarly, if traffic enters the

inside interface from an unknown source address, the security appliance drops the packet because the

matching route (the default route) indicates the outside interface.

Unicast RPF is implemented as follows:

• ICMP packets have no session, so each packet is checked.

• UDP and TCP have sessions, so the initial packet requires a reverse route lookup. Subsequent

packets arriving during the session are checked using an existing state maintained as part of the

session. Non-initial packets are checked to ensure they arrived on the same interface used by the

initial packet.

To enable Unicast RPF, enter the following command:

hostname(config)# ip verify reverse-path interface

interface_name

1 2 ... 306 307 308 309 310 311 312 313 314 315 316 ... 603 604

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 311