FMC IP fragmentation to no fragmentation settings can couse outage?

[d-kuruppu]

Hello everyone,

I have the following issue:
The customer would like to disable FMC packet fragmentation globally.

According to the Cisco documentation it is quite straightforward.
Source chapter: Fragment Settings
Cisco Secure Firewall Management Center Device Configuration Guide, 7.2 - Platform Settings [Cisco Secure Firewall Management Center] - Cisco

The question now is:
1. If there is a requested fragmented traffic flow, how can I identify (the source of the traffic) on the FMC?
2. If this setting is changed (from fragmentation to no fragmentation) on the FMC, could there be a data flow hiccup or outage?

Thank you in advanced.
BR
Dushan

[tvotna]

You cannot identify flows with fragmentation until you set "fragment chain 1" and firewall start dropping fragments. When fragment is dropped, the firewall will increment a counter ("show asp drop") and you can use "capture type asp-drop <code>" for corresponding drop code to capture traffic and analyze it. What you can do however is to evaluate the number of fragmented packets passing through the firewall: "show fragment".

In general, don't set "fragment chain 1". This doesn't disable virtual reassembly feature. This blocks fragments on the box, which can adversely affect your traffic.

[MHM Cisco World]

Dont do any capture' 

This fragment is for FMC box not for ftd control by FMC.

And note' keep defualt for fmc box as it dont modify it.

MHM

[MHM Cisco World]

Can you confirm you want fragment for fmc or ftd?

MHM

[tvotna]

@MHM Cisco World, this is a silly question.

[Aref Alsouqi]

The platform settings in the FMC are related to the FTD managed devices by that FMC. If the requirement of disabling fragmentation on the FTD is from the security perspective then I think you can leave the fragmentation enabled and configure a defragmentation preprocessor policy that would help protecting against the attacks that would leverage IP fragments.

Firepower Management Center Configuration Guide, Version 6.5 - Transport & Network Layer Preprocessors [Cisco Secure Firewall Management Center] - Cisco

[d-kuruppu]

@ all,
Thank you all for the interesting answers and I really appreciate it.

@ Aref Alsouqi
This is a very interesting alternative solution.
I will try to read and test this option on the infra lab (this week).
Next week I will try to get a traffic generator
The pentesting will take some time - but I will give you a feedback of the out come as soon as I get this done.

Cheers

[MHM Cisco World]

Sorry again' you ask about fragment of packet pass into fmc or fragments of traffic pass through ftd?

MHM

[Aref Alsouqi]

You're very welcome.