Данный функционал активируется только при наличии лицензии "Опция IPS/IDS для сервисного маршрутизатора". |
Задача: Организовать защиту в бродкастовом домене от DOS-атаки ICMP-пакетами.
Исходная конфигурация:
interface gigabitethernet 1/0/1 mode switchport exit interface gigabitethernet 1/0/3 mode switchport exit |
При коммутации трафика маршрутизатору нет надобности заглядывать в L3 заголовок, поэтому активация IPS на L2 интерфейсе не повлечет за собой инспектирование такого трафика.
esr# show security ips counters ---------------------------------------------- IPS general counters ---------------------------------------------- Packets decoded by ips engine: 0 Invalid packets decoded by ips engine: 0 Packets accepted by ips engine: 0 Packets blocked by ips engine: 0 Packets replaced by ips engine: 0 Alerts generated: 0 ---------------------------------------------- esr# show int counters подробнее Interface Packets recv Bytes recv Errors recv MC recv -------------------- -------------- -------------- -------------- -------------- gi1/0/1 522 52420 0 7 gi1/0/3 121 11554 1 1 Interface Packets sent Bytes sent Errors sent -------------------- -------------- -------------- -------------- gi1/0/1 1934 122590 0 gi1/0/3 1892 117814 0 |
Соответственно трафик идет, но счетчик не растет.
ping 192.0.2.2 packets unlimited PING 192.0.2.2 (192.0.2.2) 56 bytes of data. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!! --- 192.0.2.2 ping statistics --- 30 packets transmitted, 30 received, 0% packet loss, time 29026ms rtt min/avg/max/mdev = 0.603/1.001/1.153/0.119 ms vesr# |
Для решения данной задачи необходимо объединение интерфейсов в одну Bridge группу. Bridge позволяет одновременно коммутировать трафик и обрабатывать по заголовкам сетевого и вышестоящих уровней (подробнее. )
За счет данного свойства маршрутизатор будет анализировать L3 заголовок на этапе прохождения через Bridge, несмотря на то, что IP адресация не настроена.
Настройка IPS:
object-group network TEST
ip address-range 192.0.2.1-192.0.2.2
exit
security ips policy TEST
protect network-group TEST
exit
security ips
policy TEST
enable
exit
security ips-category user-defined USER
rule 10
action drop
protocol icmp
direction round-trip
source-address any
destination-address any
source-port any
destination-port any
meta classification-type successful-dos
meta log-message "Big ICMP DoS"
enable
exit
exit |
Инспектировать трафик будем на самом Bridge соответственно:
bridge 1 service-ips inline enable exit interface gigabitethernet 1/0/1 mode switchport bridge-group 1 exit interface gigabitethernet 1/0/3 mode switchport bridge-group 1 exit |
Далее, для того чтобы активировать фильтрацию между членами Bridge, необходимо добавить команду ports firewall enable.
Однако, после данной команды трафик будет инспектироваться не только средствами IPS, но и Firewall. Поэтому если он не настроен, то возникнет ситуация когда дропается весь трафик (подробнее). Необходимо настроить правила межзонового взаимодействия или отключить командой ip firewall disable:
bridge 1 ports firewall enable ip firewall disable service-ips inline enable exit |
Таким образом получаем корректную инспекцию на L2 интерфейсах:
2026-08-26T04:11:55+00:00 %IPS-I-INFO: [Drop] [2:10010:0] Big ICMP DoS [Classification: Denial of Service] [Priority: 2] {ICMP} 192.0.2.1:8 -> 192.0.2.2:0 \\\Лог захвата пакета
esr# show security ips counters
----------------------------------------------
IPS general counters
----------------------------------------------
Packets decoded by ips engine: 20
Invalid packets decoded by ips engine: 0
Packets accepted by ips engine: 0
Packets blocked by ips engine: 20
Packets replaced by ips engine: 0
Alerts generated: 1
----------------------------------------------
IPS Decoder engine
----------------------------------------------
Packets decoded by ips engine: 20
Bytes decoded by ips engine: 1680
Invalid packets decoded by ips engine: 0
IPv4 packets decoded by ips engine: 20
IPv6 packets decoded by ips engine: 0
TCP packets decoded by ips engine: 0
UDP packets decoded by ips engine: 0
SCTP packets decoded by ips engine: 0
ICMPv4 packets decoded by ips engine: 20
ICMPv6 packets decoded by ips engine: 0
PPP packets decoded by ips engine: 0
PPPoE packets decoded by ips engine: 0
GRE packets decoded by ips engine: 0
Teredo packets decoded by ips engine: 0
Average packets size decoded by ips engine: 84
Maximum packets size decoded by ips engine: 84
----------------------------------------------
IPS Application Layer
----------------------------------------------
HTTP Flow decoded by ips engine: 0
FTP Flow decoded by ips engine: 0
FTP-DATA Flow decoded by ips engine: 0
SMTP Flow decoded by ips engine: 0
TLS Flow decoded by ips engine: 0
SSH Flow decoded by ips engine: 0
IMAP Flow decoded by ips engine: 0
SMB Flow decoded by ips engine: 0
DCE/RPC flow over TCP decoded by ips engine: 0
DCE/RPC flow over UDP decoded by ips engine: 0
DNS flow over TCP decoded by ips engine: 0
DNS flow over UDP decoded by ips engine: 0
ENIP flow over TCP decoded by ips engine: 0
ENIP flow over UDP decoded by ips engine: 0
----------------------------------------------
IPS Flow engine
----------------------------------------------
TCP Flow decoded by ips engine: 0
UDP Flow decoded by ips engine: 0
ICMPv4 Flow decoded by ips engine: 1
ICMPv6 Flow decoded by ips engine: 0
Failed TCP Flow decoded by ips engine: 0
Failed UDP Flow decoded by ips engine: 0
Пинга нет, так как происходит блокировка ICMP:
PING 192.0.2.2 (192.0.2.2) 56 bytes of data.
..........................................................................
--- 192.0.2.2 ping statistics ---
74 packets transmitted, 0 received, 100% packet loss, time 73070ms
|