ACL issue & DOS attack

imranraheel — Mon, 11 Mar 2019 20:48:17 GMT

I have the specified configurations on my 2821 router

interface FastEthernet0/0

ip address 66.x.x.x 255.255.255.248

ip access-group INBOUND in

no ip redirects

ip nbar protocol-discovery

ip inspect fw out

speed 100

full-duplex

service-policy input FTP-QoS

service-policy output FTP-QoS

Following is the fw desctiption applied on outbound direction.

ip inspect name fw dns

ip inspect name fw tcp

ip inspect name fw udp

ip inspect name fw icmp

ip inspect name fw ftp

ip inspect name fw http

ip inspect name fw https

ip inspect name fw pop3

ip inspect name fw imap3

ip inspect name fw ntp

ip inspect name fw ftps

ip inspect name fw isakmp

ip inspect name fw ipsec-msft

ip inspect name fw l2tp

Inbound ACL Description.

Extended IP access list INBOUND

100 permit tcp any host 66.x.x.x eq 22 log (51 matches)

110 permit tcp any 209.x.x.0 0.0.0.255 eq 10111 log (9089431 matches)

120 permit tcp any 209.x.x.0 0.0.0.255 eq 10112 log

130 permit tcp any 209.x.x.0 0.0.0.255 eq 10113 log (11781 matches)

140 permit tcp any 209.x.x.0 0.0.0.255 eq 10311 log (800041 matches)

150 permit tcp any 209.x.x.0 0.0.0.255 eq 10313 log (1423114 matches)

160 permit tcp any 209.x.x.0 0.0.0.255 eq 10315 log

170 permit tcp any 209.x.x.0 0.0.0.255 eq 10316 log

180 permit tcp any 209.x.x.0 0.0.0.255 eq 10321 log (417 matches)

1700 permit tcp any any established log (175963 matches)

1710 permit icmp any any echo-reply log (1 match)

1720 deny ip any any log (211516 matches)

I have recently attacked by a DOS attack in which source port was 80 , is there any issues with my configs . As according to the above configs port 80 isnt allowed in .

Can any one please confirm.

Thanks

ACL issue & DOS attack

andhingr — Thu, 23 Jun 2011 22:45:10 GMT

Your FW is inspecting all outgoing http traffic so that return packets are allowed through the acl applied inbound on the interface. The return packets will have the source port of 80 so its possible that if there is man-in-the middle attacks somebody hijacks the initial connection going on destination port 80 and responds with source port of 80.

topic ACL issue & DOS attack in Network Security

ACL issue & DOS attack

ACL issue & DOS attack