Denial of Service (DoS) SYN Rate Protection Configuration on Sx500 Series Stackable Switches

Objective

A Denial of Service (DoS) attack is an attempt by an attacker to prevent a legitimate user from the use of the resources or services in the network. DoS attacks can result in a significant loss of time and money. DoS attack prevention is configured to increase security in the network and prevents packets with a certain IP address range to enter the network.  

TCP SYN Flooding causes servers to stop the response to requests to open a new connection with clients because of the overload by the attacker. The SYN Rate Protection page limits the number of SYN packets received by the switch on the ingress port. This can stop the SYN flooding attack on servers connected to the switch.

Note: SYN rate protection is only available if the device is in Layer 2 mode.

This article explains how to configure SYN rate protection on the Sx500 Series Stackable Switches.

Applicable Devices

• Sx500 Series Stackable Switches

Software Version

• v1.2.7.76

SYN Rate Protection

Step 1. Log in to the web configuration utility and choose Security > Denial of Service Prevention > SYN Rate Protection. The SYN Rate Protection page opens:

Step 2. Click Add to add a new SYN rate limit. The Add SYN Rate Protection window appears.

Step 3. Click the radio button that corresponds to the desired interface type in the Interface field.

• Unit/Slot — From the Unit/Slot drop-down lists choose the appropriate Unit/Slot. The unit identifies whether the switch is active or a member in the stack. The slot identifies which switch is connected to which slot (slot 1 is SF500 and slot 2 is SG500). If you are unfamiliar with the terms used, check out Cisco Business: Glossary of New Terms.

– Port — From the Port drop-down list, choose the appropriate port to configure. 

• LAG — Choose on which LAG the STP is advertised from the LAG drop-down list. A Link Aggregate Group (LAG) is used to link multiple ports together. LAGs multiply bandwidth, increase port flexibility, and provide link redundancy between two devices to optimize port usage.

Step 4. Click the radio button that corresponds with the desired IP address in the IP Address field.

• User Defined — SYN rate limit is defined to a user defined IP address.

• All addresses — SYN rate limit is defined to all IP addresses.

Step 5. Click the radio button that corresponds with the desired network mask in the Network Mask field.

• Mask — Enter the network mask in IP address format. This defines the subnet mask for the IP address.

• Prefix length — Enter the prefix length (integer in the range of 0 to 32). This defines the subnet mask by prefix length for the IP address.

Step 6. Enter a value for the SYN rate limit in the SYN Rate Limit field. This value is the max value of SYN packets that the interface can receive per second where PPS stands for packets per second.

Step 7. Click Apply.