ASA and FTD : SYN flood (DOS attack) protection

-

 

An attacker can launch a DOS attack by flooding a host with thousands of TCP SYN packets, the source address would be spoofed with no way for the host server to respond, this would create half-open TCP connections on the host consuming resources until the host is overwhelmed and packets are dropped.

On the Cisco ASA you can configure the Modular Policy Framework (MPF) to restrict the number of TCP half-open connections (embryonic-conn-max). When enabled, the MPF policy will intercept the tcp SYN and only forward the connection once the 3-way handshake is complete.

Lab:

1. Create extended ACL for the protected server

     access-list ACL-Protected-Servers extended permit tcp any host 10.1.1.10 eq www


2. Create Class-Map

  class-map CM-Protected-Servers
     match access-list ACL-Protected-Servers


3. Create Policy-Map
    policy-map PM-Outside
      class CM-Protected-Servers
         set connection embryonic-conn-max 40

4. Create service policy for outside interface
      service-policy PM-Outside interface outside


Verification:

Use tool hping3 on Kali:
sudo hping3 -c 10000 -d 120 -S -p 80 --flood --rand-source 203.0.113.10



ASA-916# sh service-policy interface outside

Interface outside:
  Service-policy: PM-Outside
    Class-map: CM-Protected-Servers
      Set connection policy: embryonic-conn-max 40
        current embryonic conns 40, drop 0
ASA-916#
ASA-916#


in ASA log:
Mar 03 2024 10:42:51: %ASA-2-106016: Deny IP spoof from (228.8.220.137) to 203.0.113.10 on interface outside
Mar 03 2024 10:42:51: %ASA-2-106016: Deny IP spoof from (234.131.52.96) to 203.0.113.10 on interface outside
Mar 03 2024 10:42:51: %ASA-2-106016: Deny IP spoof from (234.219.62.86) to 203.0.113.10 on interface outside
Mar 03 2024 10:42:51: %ASA-2-106016: Deny IP spoof from (228.221.7.241) to 203.0.113.10 on interface outside
Mar 03 2024 10:42:51: %ASA-2-106016: Deny IP spoof from (230.181.240.116) to 203.0.113.10 on interface outside
Mar 03 2024 10:42:51: %ASA-2-106016: Deny IP spoof from (230.74.97.183) to 203.0.113.10 on interface outside
Mar 03 2024 10:42:51: %ASA-2-106016: Deny IP spoof from (234.254.102.47) to 203.0.113.10 on interface outside
Mar 03 2024 10:42:51: %ASA-2-106016: Deny IP spoof from (238.86.111.78) to 203.0.113.10 on interface outside
Mar 03 2024 10:42:51: %ASA-2-106016: Deny IP spoof from (225.136.83.145) to 203.0.113.10 on interface outside
Mar 03 2024 10:42:51: %ASA-2-106016: Deny IP spoof from (239.180.22.84) to 203.0.113.10 on interface outside
Mar 03 2024 10:42:51: %ASA-2-106016: Deny IP spoof from (227.70.241.1) to 203.0.113.10 on interface outside
Mar 03 2024 10:42:51: %ASA-2-106016: Deny IP spoof from (225.186.216.179) to 203.0.113.10 on interface outside
Mar 03 2024 10:42:51: %ASA-2-106016: Deny IP spoof from (0.22.73.155) to 203.0.113.10 on interface outside
Mar 03 2024 10:42:51: %ASA-2-106016: Deny IP spoof from (239.102.93.37) to 203.0.113.10 on interface outside
Mar 03 2024 10:42:51: %ASA-2-106016: Deny IP spoof from (227.202.79.9) to 203.0.113.10 on interface outside
Mar 03 2024 10:42:51: %ASA-2-106016: Deny IP spoof from (228.9.149.120) to 203.0.113.10 on interface outside

Anti-spoofing is not enabled on outside interface, explanation of this message:

%PIX|ASA-2-106016: Deny IP spoof from (IP_address) to IP_address on 
interface interface_name.
  1. This message is generated when a packet arrives at the security appliance interface that has a destination IP address of 0.0.0.0 and a destination MAC address of the security appliance interface. In addition, this message is generated when the security appliance discarded a packet with an invalid source address, which can include one of the following or some other invalid address:
    • Loopback network (127.0.0.0)
    • Broadcast (limited, net-directed, subnet-directed, and all-subnets-directed)
    • The destination host (land.c)
    In order to further enhance spoof packet detection, use the icmp command to configure the security appliance to discard packets with source addresses belonging to the internal network. This is because the access-list command has been deprecated and is no longer guaranteed to work correctly.Recommended Action: Determine if an external user is trying to compromise the protected network. Check for misconfigured clients.

Reference

https://integratingit.wordpress.com/2018/01/07/prevent-tcp-attacks-on-cisco-asa/

https://www.firewall.cx/tools-tips-reviews/network-protocol-analyzers/performing-tcp-syn-flood-attack-and-detecting-it-with-wireshark.html


FTD:

In FTD, this is configured with Threat Defense Service Policy

1. Define a extended ACL object

2. Configure "Threat Defense Service Policy" in an ACP rule Advanced Settings.




Comments

Post a Comment

Popular posts from this blog

Firepower FMC and FTD troubleshooting

-
 1. Display real time log on FMC or FTD: pigtail for example: pigtail | grep 192.168.2.20                      pigtail | grep sftunnel 2. Restart communication channel manage_procs.pl run it from  the sensor only, run it from FMC will reset all sensors' channel. This scripts are nice to be used when the FMC and FTD have communication problems like heartbeats are not received, policy deployment is failing or events are not received > expert ************************************************************** NOTICE - Shell access will be deprecated in future releases          and will be replaced with a separate expert mode CLI. ************************************************************** admin@FTD:~$ sudo su Password: root@FTD:/home/admin# manage_procs.pl ****************  Configuration Utility  **************  1   Reconfigure Correlator  2   Reconfigure and flush Correlator  3    Restart Comm. channel  4   Update routes  5   Reset all routes  6   Validate Network  0   Exit *****
Read more

ASA IKEv1 VPN troubleshooting Steps and Tips

-
  1. Phase I proposal mismatch  Run show crypto isakmp sa  Initiator: MM_WAIT_MSG2 Responder: No info  Most likely this is phase1 proposal mismatch, verify IKEv1 policy, other symptoms:   Initiator log: Information Exchange processing failed All configured IKE versions failed to establish the tunnel Initiator debug: Received an un-encrypted NO_PROPOSAL_CHOSEN notify message, dropping Responder log: Error processing payload: Payload ID Responder debug:  All SA proposals found unacceptable 2. IKE version mismatch:  Run  show crypto isakmp sa  no info at both initiator and responder Initiator log: Removing peer from correlator table failed, no match! Reason: User Requested  All configured IKE versions failed to establish the tunnel Initiator debug: Oakley begin quick mode PHASE 1 COMPLETED IKE Initiator sending 1st QM pkt Removing peer from correlator table failed, no match! Session is being torn down. Reason: User Requested Responder log: Tunnel Rejected: Conflicting protocols specified
Read more

Firepower 2100/1100 FTD/ASA initial setup, reimage, upgrade.

-
  Chassis FXOS and FTD share same management IP (default 192.168.45.45) Chassis FXOS (192.168.45.45) and ASA ()use different management IP although on same physical interface. SSH to FXOS/FTD are on FTD CLI prompt, go to FXOS using the  connect fxos  command Console to Chassis is on FXOS CLI prompt, go to FTD using the  connect ftd  command The Firepower 1100 does not support the FXOS Firepower Chassis Manager; only a limited CLI is supported for troubleshooting purposes. The Firepower 2100 runs an underlying operating system called the Firepower eXtensible Operating System (FXOS).  If you run ASA on Firepower 2100, ASA can be in the following modes: Appliance mode (the default after ASA 9.13)—Appliance mode lets you configure all settings in the ASA. Only advanced troubleshooting commands are available from the FXOS CLI. See the  FXOS troubleshooting guide  for more information. Firepower Chassis Manager is not supported . ciscoasa# connect fxos [admin] Connecting to fxos. Connected
Read more