Strict TCP Enforcement in Sourcefire

chidambarakodandaraju — Sun, 10 Mar 2019 13:47:10 GMT

Hi Cisco Support Community team

Currently thinking as a scenario the Sourcefire NIPS are working in Blocking mode (Drop when Inline) option is enabled in the 'Intrusion Policy'

Can you please let me know 'Strict TCP Enforcement' feature in Sourcefire NIPS can it be implemented Yes or No , along with its Pros/Cons.

Do let me know your Recommendations is it worth to implement this Strict TCP Enforcement at Sourcefire NIPS 'or' Cisco ASA firewall 'or' at a DDOS Vendor these days Volumetric attacks come from attackers from Internet.

Reference url : http://www.cisco.com/c/en/us/td/docs/security/firesight/541/user-guide/FireSIGHT-System-UserGuide-v5401/IPS-Devices.html

Strict TCP Enforcement

------------------------------------

To maximize TCP security, you can enable strict enforcement, which "Blocks Connections where the Three-Way Handshake was not completed". Strict enforcement also blocks:

non-SYN TCP packets for connections where the three-way handshake was not completed
non-SYN/RST packets from the initiator on a TCP connection before the responder sends the SYN-ACK
non-SYN-ACK/RST packets from the responder on a TCP connection after the SYN but before the session is established
SYN packets on an established TCP connection from either the initiator or the responder

Regards

Chidambara

topic Strict TCP Enforcement in Sourcefire in Network Security

Strict TCP Enforcement in Sourcefire