topic Re: How to prevent SYN Flood with IOS Firewall in Network Security

How to prevent SYN Flood with IOS Firewall

proactive99 — Mon, 11 Mar 2019 19:17:16 GMT

Hello,

I'm deploying ASR1000 (also known IOS Firewall), and would like to prevent some network attacks like below with IOS Firewall. I believe there are some commands that can be configured in ASR, but i'm not sure how to use them.

1) SYN Flood attack

2) IP fragmentation attack

3) Detect and record the port scanning behavior.

Thanks in advance,

-Alejin

Re: How to prevent SYN Flood with IOS Firewall

Panos Kampanakis — Wed, 01 Dec 2010 23:56:32 GMT

1) You can set connection limits for the Zone Based Firewall to not pass many connections. But if someone start the SYN flood the firewall cannot really prevent it. It can block it, but you can't stop someone from doing it.

2) The ASR1K Zone Based Firewall feature can be set to drop fragments.

3) An IPS would do that.

Generally speaking all the above can also be done and you can be notified for them better from an IPS/IDS.

I hope it helps a little.

Re: How to prevent SYN Flood with IOS Firewall

Kureli Sankar — Thu, 02 Dec 2010 04:34:14 GMT

Engage tcp intercept for syn flood attack.

http://www.cisco.com/en/US/docs/ios/11_3/security/configuration/guide/scdenial.html#wp3654

-KS