topic deactivated signatures still causing drops in Network Security

deactivated signatures still causing drops

daniel.thompson — Sun, 10 Mar 2019 12:30:26 GMT

Hi there,

We have a site with 2x 5540 asas with SSM-20 IPS Module in active standby mode.

The signatures 1204 and 1208 relating to Fragmented IP datagrams fire on traffic even when excluded from the siganture set.

Any ideas why and how to fix this issue?

Cheers

error attach as a pic

deactivated signatures still causing drops

nicksmi — Fri, 14 Oct 2011 20:01:08 GMT

Have these signatures been retired and disabled?

Nick Smith

Cisco IPS Signature Team

deactivated signatures still causing drops

daniel.thompson — Mon, 17 Oct 2011 00:22:55 GMT

no, but all traffic from the subnets that the issue is on are specifically excluded from the IPS signature list with custom signatures. ( its an issue that requires a lowerd MTU to fix, but causes fragmenting at certain times )

Will the IPS modules STILL fire even on traffic excluded if the signatures match the traffic? How is the traffic to be excluded other than retiring the whole signature?

Cheers

deactivated signatures still causing drops

nicksmi — Mon, 17 Oct 2011 20:28:13 GMT

From a colleague,

The only way to prevent these two sigs (1204 and 1208) from firing is to retire them and then reset the sensor. Disabling them will only stop alerting, and they will continue to deny packets (this is part of the normalizer’s design). I don’t think a custom sig will work because the normalizer sigs will be processed before the custom sigs.

Sig 1204 is ‘IP Fragment Missing Initial Fragment’

And 1208 is ‘IP Fragment Incomplete Datagram’

There’s not much we can do with sig 1204. If the initial fragment is missing, we can’t do reassembly.

However, with sig 1208, we can adjust the timeout, which defaults to 60 seconds. Sixty seconds should be plenty of time though. It can be increased to up to 360 seconds by modifying fragment-reassembly-timeout.

Are the dropped frags causing network issues?