Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 313)

19-5

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 19 Intercepting and Responding to Network Attacks

Protecting Your Network Against Specific Attacks

The half-closed hh[:mm[:ss] and tcp hh[:mm[:ss] values are a time between 0:5:0 and 1192:59:59. The

default for half-closed is 0:10:0 and the default for tcp is 1:0:0. You can also set these values to 0, which

means the connection never times out.

You can enter this command all on one line (in any order), or you can enter each attribute as a separate

command. The command is combined onto one line in the running configuration.

Step 6 To activate the policy map on one or more interfaces, enter the following command:

hostname(config)# service-policy

policymap_name

{global | interface

interface_name

}

Where global applies the policy map to all interfaces, and interface applies the policy to one interface.

Only one global policy is allowed. You can override the global policy on an interface by applying a

service policy to that interface. You can only apply one policy map to each interface.

Configuring the Fragment Size

By default, the security appliance allows up to 24 fragments per IP packet, and up to 200 fragments

awaiting reassembly. You might need to let fragments on your network if you have an application that

routinely fragments packets, such as NFS over UDP. However, if you do not have an application that

fragments traffic, we recommend that you do not allow fragments through the security appliance.

Fragmented packets are often used as DoS attacks. To set disallow fragments, enter the following

command:

hostname(config)# fragment chain 1 [

interface_name

]

Enter an interface name if you want to prevent fragmentation on a specific interface. By default, this

command applies to all interfaces.

Blocking Unwanted Connections

If you know that a host is attempting to attack your network (for example, system log messages show an

attack), then you can block (or shun) connections based on the source IP address and other identifying

parameters. No new connections can be made until you remove the shun.

Note If you have an IPS that monitors traffic, such as the AIP SSM, then the IPS can shun connections

automatically.

To shun a connection manually, perform the following steps:

Step 1 If necessary, view information about the connection by entering the following command:

hostname# show conn

The security appliance shows information about each connection, such as the following:

TCP out 64.101.68.161:4300 in 10.86.194.60:23 idle 0:00:00 bytes 1297 flags UIO

Step 2 To shun connections from the source IP address, enter the following command:

hostname(config)# shun

src_ip

[

dst_ip src_port dest_port

[

protocol

]] [vlan

vlan_id

]

1 2 ... 308 309 310 311 312 313 314 315 316 317 318 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 313

Kommentare zu diesen Handbüchern