Storm-control cisco 3845

[Juan Barco]

Hi,

First of all, sorry for my english. I have been attacked to one of my public ip. I was wondering how to fix it, and I found when I am been attacked, then numer of pps in my interface goes up to 800 kpps. I was searching an I found "storm control" function. I have a Cisco 3845, can you tell me what I can do to avoid attacks.

[paul driver]

Hello

Storm control wont stop you from being  attacked - Its an access-port feature that helps your lan from being overwhelmed when its flooded with excessive broadcast/multcast/unicast traffic - This lan storm can be negated by applying thresholds on this traffic so when the specified threshold is reached the port can be shutdown or create a snmp trap message.

Do you know what kind of traffic is causing this utilization?
Do you have any router security applied or a FW between your router and the internet?
 

res

Paul

[Juan Barco]

Hi,

I know the ports on my sever under attack. I don't have any security applied on my router.

Thanks

[sotiris_pafitis]

HI milo,

So you need to add your network some access lists and inspection rules. 

Thanks. 

[paul driver · Accepted solution]

Hello

Then I suggest you either attached a fw between you router and the internet or apply some IOS security.

Basic stuff to assign:

no service finger
no service pad
no service udp-small-servers
no service tcp-small-servers
service timestamps debug datetime msec localtime show-timezone
service timestamps log datetime msec localtime show-timezone
service password-encryption
service tcp-keepalives-in
service tcp-keepalives-out

no cdp run
no ip bootp server
no ip http server
no ip finger
no ip source-route
no ip gratuitous-arps
login block-for 10 attempts 2 within 5

all FastEthernet/gig ints
-------------------------
 no ip redirects
 no ip proxy-arp
 no ip unreachables
 no ip directed-broadcast
 no ip mask-reply
 no mop enabled

all Serial interfaces
-------------------------
 no ip redirects
 no ip proxy-arp
 no ip unreachables
 no ip directed-broadcast
 no ip mask-reply

and then maybe use a simple CBAC inspection
----------------------------------------------------------------

R1
ip inspect name ios_fw TCP
ip inspect name ios_fw UDP
ip inspect name ios_fw ICMP

access-list permit 100 deny ip any any

int fax/x (WAN facing interface)
ip inspect ios_fw out
ip access-group 100 in

res

Paul

[Juan Barco]

Hi,

I will try this, thanks a lot.

[sotiris_pafitis]

Hello,

How do you know you are under attack ? And what kind of attack ?

Thanks

[Juan Barco]

Hi,

I have this tool called arbor. It shows me an strange traffic from one IP, the traffic it's like 300 Mbps, nothing normal. Arbor show me the ports 53 and 113 of my server are the ones under attack.

thanks