Hi Cisco Support Community team
Currently thinking as a scenario the Sourcefire NIPS are working in Blocking mode (Drop when Inline) option is enabled in the 'Intrusion Policy'
Can you please let me know 'Strict TCP Enforcement' feature in Sourcefire NIPS can it be implemented Yes or No , along with its Pros/Cons.
Do let me know your Recommendations is it worth to implement this Strict TCP Enforcement at Sourcefire NIPS 'or' Cisco ASA firewall 'or' at a DDOS Vendor these days Volumetric attacks come from attackers from Internet.
Reference url : http://www.cisco.com/c/en/us/td/docs/security/firesight/541/user-guide/FireSIGHT-System-UserGuide-v5401/IPS-Devices.html
Strict TCP Enforcement
------------------------------------
To maximize TCP security, you can enable strict enforcement, which "Blocks Connections where the Three-Way Handshake was not completed". Strict enforcement also blocks:
- non-SYN TCP packets for connections where the three-way handshake was not completed
- non-SYN/RST packets from the initiator on a TCP connection before the responder sends the SYN-ACK
- non-SYN-ACK/RST packets from the responder on a TCP connection after the SYN but before the session is established
- SYN packets on an established TCP connection from either the initiator or the responder
Regards
Chidambara
