Management of protection against network attacks
ip firewall screen dos-defense icmp-threshold
This command enables the protection against ICMP flood attacks. When the protection is enabled, the amount of all types ICMP packets per second for one destination address is limited.
The use of a negative form (no) of the command disables ICMP flood protection.
Syntax
ip firewall screen dos-defense icmp-threshold { <NUM> }
no ip firewall screen dos-defense icmp-threshold
Parameters
<NUM> – amount of ICMP packets per second, set in the range of [1..10000]
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen dos-defense icmp-threshold 2000
ip firewall screen dos-defense land
This command enables the protection against land attacks. When the protection is enabled, the packets with the same source and destination IP addresses and with SYN flag in TCP header are blocked.
The use of a negative form (no) of the command disables land attacks protection.
Syntax
[no] ip firewall screen dos-defense land
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen dos-defense land
ip firewall screen dos-defense limit-session-destination
When the host IP sessions table is overfilled, the host is unable to establish new sessions and it drops the requests (this may happen during various DoS attacks: SYN flood, UDP flood, ICMP flood and etc.). The command enables the limitation on the amount of simultaneous sessions, based on the source address, that mitigates DoS attacks.
The use of a negative form of the command (no) removes the limit on the number of simultaneous ip-sessions based on the destination address.
Syntax
ip firewall screen dos-defense limit-session-destination { <NUM> }
no ip firewall screen dos-defense limit-session-destination
Parameters
<NUM> – limitation on amount of IP sessions, set in the range of [1..10000].
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen dos-defense limit-session-destination 1000
ip firewall screen dos-defense limit-session-source
When the host IP sessions table is overfilled, the host is unable to establish new sessions and it drops the requests (this may happen during various DoS attacks: SYN flood, UDP flood, ICMP flood and etc.). The command enables the limitation on the amount of simultaneous sessions, based on the source address, that mitigates DoS attacks.
The use of a negative form of the command (no) removes the limit on the number of simultaneous ip-sessions based on the source address.
Syntax
ip firewall screen dos-defense limit-session-source { <NUM> }
no ip firewall screen dos-defense limit-session-source
Parameters
<NUM> – limitation on amount of IP sessions, set in the range of [1..10000].
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen dos-defense limit-session-source 1000
ip firewall screen dos-defense syn-flood
This command enables the protection against SYN flood attacks. When the protection is enabled, the amount of TCP packets with the SYN flag set per second for one destination address is limited.
The use of a negative form (no) of the command disables ICMP SYN protection.
Syntax
ip firewall screen dos-defense syn-flood { <NUM> } [src-dsr]
no ip firewall screen dos-defense syn-flood
Parameters
<NUM> – maximum amount of TCP packets with the set SYN flag per second, set in the range of [1..10000].
src-dst – limitation on the amount of TCP packets with the SYN flag set, based on the source and destination addresses.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen dos-defense syn-flood 100 src-dsr
ip firewall screen dos-defense udp-threshold
This command enables the protection against UDP flood attacks. When the protection is enabled, the amount of UDP packets per second for one destination address is limited.
The use of a negative form (no) of the command disables UDP flood protection.
Syntax
ip firewall screen dos-defense udp-threshold { <NUM> }
no ip firewall screen dos-defense udp-threshold
Parameters
<NUM> – maximum amount of UDP packets per second, set in the range of [1..10000].
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen dos-defense udp-threshold
ip firewall screen dos-defense winnuke
This command enables the protection against winnuke attacks. When the protection is enabled, TCP packets with the URG flag set and 139 destination port are blocked.
The use of a negative form (no) of the command disables winnuke attacks protection.
Syntax
[no] ip firewall screen dos-defense winnuke
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen dos-defense winnuke
ip firewall screen spy-blocking fin-no-ack
This command enables the blocking of TCP packets with the FIN flag set and the ACK flag not set.
The use of a negative form (no) of the command disables the blocking of TCP packets with the FIN flag set and the ACK flag not set.
Syntax
[no] ip firewall screen spy-blocking fin-no-ack
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen spy-blocking fin-no-ack
ip firewall screen spy-blocking icmp-type destination-unreachable
This command enables the blocking of all 3 type ICMP packets (destination-unreachable) including the packets generated by the router itself.
The use of a negative form of the command (no) disables blocking of ICMP packets of type 3.
Syntax
[no] ip firewall screen spy-blocking icmp-type destination-unreachable
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen spy-blocking icmp-type destination-unreachable
ip firewall screen spy-blocking icmp-type echo-request
This command enables the blocking of all 8 type ICMP packets (echo-request) including the packets generated by the router itself.
The use of a negative form of the command (no) disables blocking of ICMP packets of type 8.
Syntax
[no] ip firewall screen spy-blocking icmp-type echo-request
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen spy-blocking icmp-type echo-request
ip firewall screen spy-blocking icmp-type reserved
This command enables the blocking of all 2 and 7 type ICMP packets (reserved) including the packets generated by the router itself.
The use of a negative form of the command (no) disables blocking of ICMP packets of type 2 and 7.
Syntax
[no] ip firewall screen spy-blocking icmp-type reserved
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen spy-blocking icmp-type reserved
ip firewall screen spy-blocking icmp-type source-quench
This command enables the blocking of all 4 type ICMP packets (source quench) including the packets generated by the router itself.
The use of a negative form of the command (no) disables blocking of ICMP packets of type 4.
Syntax
[no] ip firewall screen spy-blocking icmp-type source-quench
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen spy-blocking icmp-type source-quench
ip firewall screen spy-blocking icmp-type time-exceeded
This command enables the blocking of all 11 type ICMP packets (time exceeded) including the packets generated by the router itself.
The use of a negative form of the command (no) disables blocking of ICMP packets of type 11.
Syntax
[no] ip firewall screen spy-blocking icmp-type time-exceeded
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen spy-blocking icmp-type time-exceeded
ip firewall screen spy-blocking ip-sweep
This command enables the protection against IP-sweep attacks. When the protection is enabled, if more than 10 ICMP requests from one source arrive within the specified interval, the first 10 requests are dropped by the router and 11th with the following ones are discarded for the remaining interval time.
The use of a negative form (no) of the command disables ip-sweep protection.
Syntax
ip firewall screen spy-blocking ip-sweep { <NUM> }
no ip firewall screen spy-blocking ip-sweep
Parameters
<NUM> – ip sweep attack detection time, set in milliseconds [1..1000000].
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen spy-blocking ip-sweep 1000
ip firewall screen spy-blocking port-scan
This command enables the protection against port scan attacks. If more than 10 TCP packets with the SYN flag arrive to one source within the first specified interval (<threshold>), then this behaviour is recorded as port scan attack and all the following packets of that type are blocked for the second specified time interval (<TIME>).
The use of a negative form (no) of the command disables protection from port scan attacks.
Syntax
ip firewall screen spy-blocking port-scan { <threshold> } [ <TIME> ]
no ip firewall screen spy-blocking port-scan
Parameters
<threshold> – interval in milliseconds during which the port scan attack will be recorded [1..1000000].
<TIME> – blocking time in milliseconds [1..1000000].
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen spy-blocking port-scan 100 1000
ip firewall screen spy-blocking spoofing
This command enables the protection against ip spoofing attacks. When the protection is enabled, the router checks packets for matching the source address and routing table entries, and in case of mismatch the packet is dropped. For example, if a packet with source address 10.0.0.1/24 arrives to the Gi1/0/1 interface and the given subnet is located after the Gi1/0/2 interface in the routing table, it is considered that the source address has been replaced.
The use of a negative form (no) of the command disables ip spoofing protection.
Syntax
[no] ip firewall screen spy-blocking spoofing
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen spy-blocking spoofing
ip firewall screen spy-blocking syn-fin
This command enables the blocking of TCP packets, with the SYN and FIN flags set.
The use of a negative form (no) of the command disables the blocking of TCP packets, with the SYN and FIN flags set.
Syntax
[no] ip firewall screen spy-blocking syn-fin
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen spy-blocking syn-fin
ip firewall screen spy-blocking tcp-all-flags
This command enables the blocking of TCP packets, with all flags or with the set of flags: FIN, PSH, URG. The protection against XMAS attack is provided.
The use of a negative for of the command disables the blocking of TCP packets, with all flags or with the set of flags: FIN,PSH,URG.
Syntax
[no] ip firewall screen spy-blocking tcp-all-flag
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
10
Command mode
CONFIG
Example
esr(config)# ip firewall screen spy-blocking tcp-all-flag
ip firewall screen spy-blocking tcp-no-flag
This command enables the blocking of TCP packets with the zero 'flags' field.
The use of a negative form (no) of the command disables the blocking of TCP packets with the zero 'flags' field.
Syntax
[no] ip firewall screen spy-blocking tcp-no-flag
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen spy-blocking tcp-no-flag
ip firewall screen suspicious-packets icmp-fragment
This command enables the blocking of fragmented ICMP packets.
The use of a negative form (no) of the command disables the blocking of fragmented ICMP packets.
Syntax
[no] ip firewall screen suspicious-packets icmp-fragment
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
10
Command mode
CONFIG
Example
esr(config)# ip firewall screen suspicious-packets icmp-fragment
ip firewall screen suspicious-packets ip-fragment
This command enables the blocking of fragmented IP packets.
The use of a negative form (no) of the command disables the blocking of fragmented IP packets.
Syntax
[no] ip firewall screen suspicious-packets ip-fragment
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen suspicious-packets ip-fragment
ip firewall screen suspicious-packets large-icmp
This command enables the blocking of ICMP packets more than 1024 bytes.
The use of a negative form of the command (no) disables blocking of ICMP packets more than 1024 bytes.
Syntax
[no] ip firewall screen suspicious-packets large-icmp
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen suspicious-packets large-icmp
ip firewall screen suspicious-packets syn-fragment
This command enables the blocking of fragmented TCP packets with the SYN flag.
The use of a negative form (no) of the command disables the blocking of TCP packets with the SYN flag.
Syntax
[no] ip firewall screen suspicious-packets syn-fragment
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen suspicious-packets syn-fragment
ip firewall screen suspicious-packets udp-fragment
This command enables the blocking of fragmented UDP packets.
The use of a negative form (no) of the command disables blocking of fragmented UDP packets.
Syntax
[no] ip firewall screen suspicious-packets udp-fragment
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen suspicious-packets udp-fragment
ip firewall screen suspicious-packets unknown-protocols
This command enables the blocking of packets, with the protocol ID contained in IP header equal to 137 and more.
The use of a negative form (no) of the command disables the blocking of packets, with the protocol ID contained in IP header equal to 137 and more.
Syntax
[no] ip firewall screen suspicious-packets unknown-protocols
Parameters
The command does not contain parameters.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall screen suspicious-packets unknown-protocols
Management of network attacks notification
ip firewall logging interval
Set the frequency of notification (via SNMP, syslog and in CLI) of detected and blocked network attacks When an attack is detected, a message is logged instantly, but the following alerts about this particular attack will be logged after a specified time interval, if the attack is continuous.
The use of a negative form (no) of the command returns the timer to the default value.
Syntax
ip firewall logging interval <NUM>
no ip firewall logging interval
Parameters
<NUM> – time interval in seconds [30 .. 2147483647]
Default value
30
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# ip firewall logging interval 60
logging firewall screen detailed
This command enables more detailed message output about detected and blocked network attacks in the CLI.
The use of a negative form (no) of the command disables detailed message output.
Syntax
[no] logging firewall screen detailed
Parameters
None.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# logging firewall screen detailed
logging firewall screen dos-defense
This command enables the mechanism of DoS attacks detection and logging via CLI, syslog and SNMP. In conjunction with the included protection against attacks, an alert will be generated about the reflected DoS attacks.
The use of a negative form (no) of the command disables the mechanism of detection and logging of detected and reflected DoS attacks.
Syntax
[no] logging firewall screen dos-defense <ATACK_TYPE>
Parameters
<ATACK_TYPE> – DoS attack type, takes the following values:
- icmp-threshold;
- land;
- limit-session-destination;
- limit-session-source;
- syn-flood;
- udp-threshold;
For a detailed description of DoS attacks, see Managing protection against network attacks.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# logging firewall screen dos-defense land
logging firewall screen spy-blocking
This command enables the mechanism of spyware activity detection and logging via CLI, syslog and SNMP. In conjunction with the anti-spyware protection enabled, an alert will be issued about blocked spyware activity.
The use of a negative form (no) of the command disables the mechanism of detection and logging of detected and reflected spyware activity.
Syntax
[no] logging firewall screen spy-blocking { <ATACK_TYPE> | icmp-type <ICMP_TYPE> }
Parameters
<ATACK_TYPE> – espionage activity type, takes the following values:
- fin-no-ack;
- ip-sweep;
- port-scan;
- spoofing;
- syn-fin;
- tcp-all-flag;
- tcp-no-flag.
<ICMP_TYPE> – icmp type, takes values:
- destination-unreachable;
- echo-request;
- reserved;
- source-quench;
- time-exceeded.
For a detailed description of spy activities, see Managing protection against network attacks.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# logging firewall screen spy-blocking icmp-type echo-request
logging firewall screen suspicious-packets
This command enables the mechanism of non-standard packets detection and logging via CLI, syslog and SNMP. In conjunction with the included protection against non-standard packets, a notification will also be issued about blocking non-standard packets.
The use of a negative form (no) of the command disables the mechanism of detection and logging of detected and blocked non-standard packets.
Syntax
[no] logging firewall screen suspicious-packets <PACKET_TYPE>
Parameters
<PACKET_TYPE> – specialized packets type, takes the following values:
- icmp-fragment;
- ip-fragment;
- large-icmp;
- syn-fragment;
- udp-fragment;
- unknown-protocols.
For a detailed description of protection against non-standard packets, see Managing protection against network attacks.
Default value
Disabled.
Required privilege level
15
Command mode
CONFIG
Example
esr(config)# logging firewall screen suspicious-packets icmp-fragment
show ip firewall screens counters
This command allows you to view statistics on detected network attacks.
Syntax
show ip firewall screens counters
Parameters
None.
Required privilege level
10
Command mode
ROOT
Example
esr# show ip firewall screens counters
DDoS:
Destination limit screen: --
Source limit screen: --
ICMP threshold screen: 1
UDP threshold screen: --
SYN flood screen: 0
Land attack screen: 1
Winnuke attack screen: --
Suspicious packets:
ICMP fragmented screen: --
UDP fragmented screen: --
Large ICMP screen: 4
Fragmented SYN screen: --
Unknown protocol screen: --
Fragmented IP screen: --
Spying:
Port scanning screen: --
IP sweep secreen: --
SYN-FIN screen: --
TCP all flags screen: --
FIN no ACK screen: --
TCP no flags screen: --
Spoofing screen: --
ICMP types:
ICMP reserved screen: --
ICMP quench screen: --
ICMP echo request screen: --
ICMP time exceeded screen: --
ICMP unreachable screen: --