Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 312)

19-4

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 19 Intercepting and Responding to Network Attacks

Protecting Your Network Against Specific Attacks

Configuring Connection Limits and Timeouts

This section describes how to set maximum TCP and UDP connections, maximum embryonic

connections, connection timeouts, and how to disable TCP sequence randomization.

Limiting the number of connections and embryonic connections protects you from a DoS attack. The

security appliance uses the embryonic limit to trigger TCP Intercept, which protects inside systems from

a DoS attack perpetrated by flooding an interface with TCP SYN packets. An embryonic connection is

a connection request that has not finished the necessary handshake between source and destination.

TCP sequence randomization should only be disabled if another in-line firewall is also randomizing

sequence numbers and the result is scrambling the data. Each TCP connection has two Initial Sequence

Numbers (ISNs): one generated by the client and one generated by the server. The security appliance

randomizes the ISN that is generated by the host/server. At least one of the ISNs must be randomly

generated so that attackers cannot predict the next ISN and potentially hijack the session.

Note You can also configure maximum connections, maximum embryonic connections, and TCP sequence

randomization in the NAT configuration. If you configure these settings for the same traffic using both

methods, then the security appliance uses the lower limit. For TCP sequence randomization, if it is

disabled using either method, then the security appliance disables TCP sequence randomization.

To set connection limits, perform the following steps:

Step 1 To identify the traffic, add a class map using the class-map command according to Chapter 18, “Using

Modular Policy Framework.”

Step 2 To add or edit a policy map that sets the actions to take with the class map traffic, enter the following

command:

hostname(config)# policy-map

name

Step 3 To identify the class map from Step 1 to which you want to assign an action, enter the following

command:

hostname(config-pmap)# class

class_map_name

Step 4 To set the maximum connections (both TCP and UDP), maximum embryonic connections, or whether to

disable TCP sequence randomization, enter the following command:

hostname(config-pmap-c)# set connection {[conn-max

number

] [embryonic-conn-max

number

]

[random-sequence-number {enable | disable}}

Where number is an integer between 0 and 65535. The default is 0, which means no limit on connections.

You can enter this command all on one line (in any order), or you can enter each attribute as a separate

command. The command is combined onto one line in the running configuration.

Step 5 To set the timeout for connections, embryonic connections (half-opened), and half-closed connections,

enter the following command:

hostname(config-pmap-c)# set connection {[embryonic

]]]

[half-closed

]]] [tcp

]]]}

Where embryonic hh[:mm[:ss] is a time between 0:0:5 and 1192:59:59. The default is 0:0:30. You can

also set this value to 0, which means the connection never times out.

1 2 ... 307 308 309 310 311 312 313 314 315 316 317 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 312

Kommentare zu diesen Handbüchern