Hello;
We currently are operating a campus network with two 75XX routers serving approx. 1000 users. These routers are running HSRP and Stateful NAT to allow internal users access to the Internet.
ACL's are applied inbound to prevent ICMP and other MS exploits from bringing down the network in the event of a SLAMMER or BLASTER/NACHI attack using ICMP or TCP 135-139/445.
However, several nasty worms attempt DOS attacks by using plain old port 80 to overload their targets (usually MS). This results in 10's of thousands of NAT sessions being opened on the router, eventually resulting in a router crash due to memory fragmentation.
As a solution, I would like to limit the amount of NAT sessions a given subnet/subinterface may be permitted to open so that if a worm gets launched, the subnet would simply become maxxed-out and prevent additional sessions from being opened.
A cursory CCO search shows me that there is a NAT rate-limiting feature available, but it only allows 1 NAT rate-limiting rule for the whole router! This is not feasible, as a single rouge machine would bring the router up to its max. NAT limit and prevent other users from surfing.
Additionally, I don't want to rate-limit HTTP, as that would affect the users' surfing experience as well.
I also am considering an external NAT device that would sit next to the 75XX's that could handle more sessions during a DOS, but I think that I would end up losing the Stateful NAT feature, which has proven to be a near-perfect redundancy feature that results in users never experiencing downtime during an HSRP failover.
Any comments or suggestions are sincerely appreciated.
