Cisco
IOS Stateful Packet Inspection provides protection from DoS attacks as a
default when an inspection rule is applied. The DoS protection is
enabled on the interface, in the direction in which the firewall is
applied, for the protocols that the firewall policy is configured to
inspect. DoS protection is only enabled on network traffic if the
traffic enters or leaves an interface with inspection applied in the
same direction of the traffic's initial movement. Cisco IOS Firewall
inspection provides several adjustable values to protect against DoS
attacks. These settings have default values that may interfere with
proper network operation if they are not configured for the appropriate
level of network activity in networks where connection rates will exceed
the defaults:
ip inspect max-incomplete high value (default 500)
ip inspect max-incomplete low value (default 400)
ip inspect one-minute high value (default 500)
ip inspect one-minute low value (default 400)
ip inspect tcp max-incomplete host value (default 50) [block-time minutes (default 0)]
These parameters allow you to configure the points at which your firewall router's DoS protection begins to take effect. When your router's DoS counters exceed the default or configured values, the router will reset one old half-open connection for every new connection that exceeds the configured max-incomplete or one-minute high values, until the number of half-open sessions drops below the max-incomplete low values. The router will send a syslog message if logging is enabled, and if an intrusion prevention system (IPS) is configured on the router, the firewall router will send a DoS signature message via Security Device Event Exchange (SDEE). If the DoS parameters are not adjusted to your network's normal behavior, normal network activity may trigger the DoS protection mechanism, causing application failures, poor network performance, and high CPU utilization on the Cisco IOS Firewall router.
While you cannot "disable" your firewall's DoS protection, you can adjust the DoS protection so that it will not take effect unless a very large number of half-open connections are present in your firewall router's Stateful Inspection session table.
Follow this procedure to tune your firewall's DoS protection to your network's activity:
Step 1.
Be sure your network is not infected with viruses or worms that could
lead to erroneously large half-open connection values and attempted
connection rates. If your network is not "clean", there is no way to
properly adjust your firewall's DoS protection.
Step 2. Set the max-incomplete high values to very high values:
ip inspect max-incomplete high 20000000
ip inspect one-minute high 100000000
ip inspect tcp max-incomplete host 100000 block-time 0
This
will prevent the router from providing DoS protection while you observe
your network's connection patterns. If you wish to leave DoS protection
disabled, stop following this procedure now.
Step 3. Clear the Cisco IOS Firewall statistics, using the following command:
show ip inspect statistics reset
Step 4. Leave the router configured in this state for some time, perhaps as long as 24 to 48 hours, so you can observe the network's pattern over a full day's activity cycle.
Note: While the values are adjusted to very high levels, your network will not benefit from Cisco IOS Firewall or IPS DoS protection.
Step 5.
After the observation period, check the DoS counters with the following
command. The parameters you must observe to tune your DoS protection
are highlighted in bold:
router#show ip inspect statistics
Packet inspection statistics [process switch:fast switch]
tcp packets: [528:22519]
udp packets: [318:0]
Interfaces configured for inspection 1
Session creations since subsystem startup or last reset 766
Current session counts (estab/half-open/terminating) [1:0:0]
Maxever session counts (estab/half-open/terminating) [48:12:5]
Last session created 00:12:21
Last statistic reset never
Last session creation rate 0
Last half-open session total 0
Step 6. Configure "ip inspect max-incomplete high" to a value 25-percent higher than your router's indicated maxever session count half-open value. A 1.25 multiplier offers 25-percent headroom above observed behavior.
For example:
Maxever session count (estab/half-open/terminating) [920:460:331]
460 * 1.25 = 575
Thus, configure:
router(config)#ip inspect max-incomplete high 575
Step 7. Configure "ip inspect max-incomplete low" to the value your router displayed for its maxever session count half-open value.
For example:
Maxever session counts (estab/half-open/terminating) [920:460:331]
Thus, configure:
router(config)#ip inspect max-incomplete low 460
Step 8.
The counter for "ip inspect one-minute high" and "one-minute low"
maintains a sum of all TCP, UDP, and Internet Control Message Protocol
(ICMP) connection attempts during the preceding minute of the router's
operation, whether the connections have been successful or not. A rising
connection rate could be indicative of a worm infection on a private
network, or an attempted DoS attack against a server.
Cisco
IOS Software does not maintain a value of the maxever one-minute
connection rate, so you must calculate the value you will apply based on
observed maxever values. While the maximum indicated values for
established, half-open, and terminating sessions are unlikely to occur
in the same instant, the calculated values used for the one-minute
settings have been observed to be reasonably accurate. To calculate the ip inspect one-minute low value, add the indicated "established" value by three.
For example:
Maxever session counts (estab/half-open/terminating) [920:460:331]
920 * 3 = 2760
Thus, configure:
ip inspect one-minute low 2760
Step 9. Calculate and configure "ip inspect one-minute high". The ip inspect one-minute high value should be 25-percent greater than the calculated one-minute low value.
For example:
ip inspect one-minute low (2760) * 1.25 = 3450
Thus, configure:
ip inspect one-minute high 3450
Step 10.
You will need to define a value for "ip inspect tcp max-incomplete
host" according to your understanding of your servers' capability.
