Configuring Firewall TCP SYN Cookie

The Firewall TCP SYN Cookie feature protects your firewall from TCP SYN-flooding attacks. TCP SYN-flooding attacks are a type of denial-of-service (DoS) attack. Usually, TCP synchronization (SYN) packets are sent to a targeted end host or a range of subnet addresses behind the firewall. These TCP SYN packets have spoofed source IP addresses. A spoofing attack is when a person or a program pretends to be another by falsifying data and thereby gaining an illegitimate advantage. TCP SYN-flooding can take up all resources on a firewall or an end host, thereby causing DoS to legitimate traffic. To prevent TCP SYN-flooding on a firewall and the end hosts behind the firewall, you must configure the Firewall TCP SYN Cookie feature.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Restrictions for Configuring Firewall TCP SYN Cookie

  • Because a default zone does not support zone type parameter map, you cannot configure the Firewall TCP SYN Cookie feature for a default zone.

  • The Firewall TCP SYN Cookie feature does not support per-subscriber firewall.

Information About Configuring Firewall TCP SYN Cookie

TCP SYN Flood Attacks

The Firewall TCP SYN Cookie feature implements software to protect the firewall from TCP SYN-flooding attacks, which are a type of DoS attack.

A SYN-flooding attack occurs when a hacker floods a server with a barrage of requests for connection. Because these messages have unreachable return addresses, the connections cannot be established. The resulting volume of unresolved open connections eventually overwhelms the server and can cause it to deny service to valid requests, thereby preventing legitimate users from connecting to a website, accessing e-mail, using FTP service, and so on.

SYN flood attacks are divided into two types:

  • Host flood—SYN flood packets are sent to a single host aiming to utilize all resources on that host.

  • Firewall session table flood—SYN flood packets are sent to a range of addresses behind the firewall, with the aim of exhausting the session table resources on the firewall and thereby denying resources to the legitimate traffic going through the firewall.

The Firewall TCP SYN Cookie feature helps prevent SYN-flooding attacks by intercepting and validating TCP connection requests. The firewall intercepts TCP SYN packets that are sent from clients to servers. When the TCP SYN cookie is triggered, it acts on all SYN packets that are destined to the configured VPN Routing and Forwarding (VRF) or zone. The TCP SYN cookie establishes a connection with the client on behalf of the destination server and another connection with the server on behalf of the client and knits together the two half-connections transparently. Thus, connection attempts from unreachable hosts will never reach the server. The TCP SYN cookie intercepts and forwards packets throughout the duration of the connection.

The Firewall TCP SYN Cookie feature provides session table SYN flood protection for the global routing domain and for the VRF domain. Because the firewall saves sessions in a global table, you can configure a limit to the number of TCP half-opened sessions. A TCP half-opened session is a session that has not reached the established state. In a VRF-aware firewall, you can configure a limit to the number of TCP half-opened sessions for each VRF. At both the global level and at the VRF level, when the configured limit is reached, the TCP SYN cookie verifies the source of the half-opened sessions before creating more sessions.

How to Configure Firewall TCP SYN Cookie

Configuring Firewall Host Protection

TCP SYN packets are sent to a single host with the aim of taking over all resources on the host. You can configure host protection only for the source zone. Configuring protection on the destination zone will not protect the destination zone from TCP SYN attacks.

Perform this task to configure the firewall host protection.


Note

You can specify the show commands in any order.

SUMMARY STEPS

    1.    enable

    2.    configure terminal

    3.    parameter-map type inspect-zone zone-pmap-name

    4.    tcp syn-flood rate per-destination maximum-rate

    5.    max-destination limit

    6.    exit

    7.    zone security zone-name

    8.    protection parameter-map-name

    9.    exit

    10.    show parameter-map type inspect-zone zone-pmap-name

    11.    show zone security

    12.    show policy-firewall stats zone zone-name


DETAILED STEPS
     Command or ActionPurpose
    Step 1 enable


    Example:
    Router> enable
     

    Enables privileged EXEC mode.

    • Enter your password if prompted.

     
    Step 2 configure terminal


    Example:
    Router# configure terminal
     

    Enters global configuration mode.

     
    Step 3 parameter-map type inspect-zone zone-pmap-name


    Example:
    Router(config)# parameter-map type inspect-zone zone-pmap
     

    Configures an inspect zone type parameter map and enters profile configuration mode.

     
    Step 4 tcp syn-flood rate per-destination maximum-rate


    Example:
    Router(config-profile)# tcp syn-flood rate per-destination 400
     

    Configures the number of SYN flood packets per second for each destination address.

    • If the rate of SYN packets sent to a particular destination address exceeds the per-destination limit, the firewall starts processing SYN cookies for SYN packets that are routed to the destination address.

     
    Step 5 max-destination limit


    Example:
    Router(config-profile)# max-destination 10000
     

    Configures the maximum number of destinations that the firewall can track for a zone.

    • The firewall drops the SYN packets if the maximum destination crosses the limit that is configured by using the limit argument.

     
    Step 6 exit


    Example:
    Router(config-profile)# exit
     

    Exits profile configuration mode and enters global configuration mode.

     
    Step 7 zone security zone-name


    Example:
    Router(config)# zone security secure-zone
     

    Configures a security zone and enters security zone configuration mode.

     
    Step 8 protection parameter-map-name


    Example:
    Router(config-sec-zone)# protection zone-pmap
     

    Configures protection for the specified zone using the parameter map.

     
    Step 9 exit


    Example:
    Router(config-sec-zone)# exit
     

    Exits security zone configuration and enters privileged EXEC mode.

     
    Step 10 show parameter-map type inspect-zone zone-pmap-name


    Example:
    Router# show parameter-map type inspect-zone zone-pmap
     

    (Optional) Displays details about the inspect zone type parameter map.

     
    Step 11 show zone security


    Example:
    Router# show zone security
     

    (Optional) Displays zone security information.

     
    Step 12 show policy-firewall stats zone zone-name


    Example:
    Router# show policy-firewall stats zone secure-zone
     

    (Optional) Displays how many SYN packets exceeded the packet limit and were processed by SYN cookies.

     

    Configuring Firewall Session Table Protection

    TCP SYN packets are sent to a range of addresses behind the firewall aiming to exhaust the session table resources on the firewall, thereby denying resources to the legitimate traffic going through the firewall. You can configure firewall session table protection either for the global routing domain or for the VRF domain.

    Configuring Firewall Session Table Protection for Global Routing Domain

    Perform this task to configure firewall session table protection for global routing domains.


    Note

    A global parameter map takes effect on the global routing domain and not at the router level.

    SUMMARY STEPS

      1.    enable

      2.    configure terminal

      3.    parameter-map type inspect global

      4.    tcp syn-flood limit number

      5.    end

      6.    show policy-firewall stats vrf global


    DETAILED STEPS
       Command or ActionPurpose
      Step 1 enable


      Example:
      Router> enable
       

      Enables privileged EXEC mode.

      • Enter your password if prompted.

       
      Step 2 configure terminal


      Example:
      Router# configure terminal
       

      Enters global configuration mode.

       
      Step 3 parameter-map type inspect global


      Example:
      Router(config)# parameter-map type inspect global
       

      Configures a global parameter map and enters profile configuration mode.

       
      Step 4 tcp syn-flood limit number


      Example:
      Router(config-profile)# tcp syn-flood limit 500
       

      Limits the number of TCP half-open sessions that triggers SYN cookie processing for new SYN packets.

       
      Step 5 end


      Example:
      Router(config-profile)# end
       

      Exits profile configuration mode and enters privileged EXEC mode.

       
      Step 6 show policy-firewall stats vrf global


      Example:
      Router# show policy-firewall stats vrf global
       

      (Optional) Displays the status of the global VRF firewall policy.

      • The command output also displays how many TCP half-open sessions are present.

       

      Configuring Firewall Session Table Protection for VRF Domain

      Perform this task to configure the firewall session table protection for VRF domains.


      Note

      You can specify the show commands in any order.

      SUMMARY STEPS

        1.    enable

        2.    configure terminal

        3.    parameter-map type inspect-vrf vrf-pmap-name

        4.    tcp syn-flood limit number

        5.    exit

        6.    parameter-map type inspect global

        7.    vrf vrf-name inspect parameter-map-name

        8.    end

        9.    show parameter-map type inspect-vrf

        10.    show policy-firewall stats vrf vrf-name


      DETAILED STEPS
         Command or ActionPurpose
        Step 1 enable


        Example:
        Router> enable
         

        Enables privileged EXEC mode.

        • Enter your password if prompted.

         
        Step 2 configure terminal


        Example:
        Router# configure terminal
         

        Enters global configuration mode.

         
        Step 3 parameter-map type inspect-vrf vrf-pmap-name


        Example:
        Router(config)# parameter-map type inspect-vrf vrf-pmap
         

        Configures an inspect-VRF type parameter map and enters profile configuration mode.

         
        Step 4 tcp syn-flood limit number


        Example:
        Router(config-profile)# tcp syn-flood limit 200
         

        Limits the number of TCP half-open sessions that triggers SYN cookie processing for new SYN packets.

         
        Step 5 exit


        Example:
        Router(config-profile)# exit
         

        Exits profile configuration mode and enters global configuration mode.

         
        Step 6 parameter-map type inspect global


        Example:
        Router(config)# parameter-map type inspect global
         

        Binds the inspect-VRF type parameter map to a VRF and enters profile configuration mode.

         
        Step 7 vrf vrf-name inspect parameter-map-name


        Example:
        Router(config-profile)# vrf vrf1 inspect vrf-pmap
         

        Binds the parameter map to the VRF.

         
        Step 8 end


        Example:
        Router(config-profile)# end
         

        Exits profile configuration mode and enters privileged EXEC mode.

         
        Step 9 show parameter-map type inspect-vrf


        Example:
        Router# show parameter-map type inspect-vrf
         

        (Optional) Displays information about inspect VRF type parameter map.

         
        Step 10 show policy-firewall stats vrf vrf-name


        Example:
        Router# show policy-firewall stats vrf vrf-pmap
         

        (Optional) Displays the status of the VRF firewall policy.

        • The command output also displays how many TCP half-open sessions are present.

         

        Configuration Examples for Firewall TCP SYN Cookie

        Example Configuring Firewall Host Protection

        The following example shows how to configure the firewall host protection: 

        Router(config)# parameter-map type inspect-zone zone-pmap
        Router(config-profile)# tcp syn-flood rate per-destination 400
        Router(config-profile)# max-destination 10000

        Router(config-profile)# exit
        Router(config)# zone security secure-zone
        Router(config-sec-zone)# protection zone-pmap

        Example Configuring Firewall Session Table Protection

        Global Parameter Map

        The following example shows how to configure firewall session table protection for global routing domains: 

        Router# configure terminal
        Router(config)# parameter-map type inspect global
        Router(config-profile)# tcp syn-flood limit 500
        Router(config-profile)# end

        Inspect-VRF Type Parameter Map

        The following example shows how to configure firewall session table protection for VRF domains: 

        Router# configure terminal
        Router(config)# parameter-map type inspect-vrf vrf-pmap
        Router(config-profile)# tcp syn-flood limit 200
        Router(config-profile)# exit
        Router(config)# parameter-map type inspect global
        Router(config-profile)# vrf vrf1 inspect vrf-pmap
        Router(config-profile)# end

        Additional References for Firewall TCP SYN Cookie

        Related Documents

        Related Topic

        Document Title

        Cisco IOS commands

        Cisco IOS Master Command List, All Releases

        Security commands

        Technical Assistance

        Description

        Link

        The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password.

        http:/​/​www.cisco.com/​cisco/​web/​support/​index.html

        Feature Information for Configuring Firewall TCP SYN Cookie

        The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.

        Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.
        Table 1 Feature Information for Configuring Firewall TCP SYN Cookie

        Feature Name

        Releases

        Feature Information

        Firewall TCP SYN Cookie

        Cisco IOS XE Release 3.3S

        The Firewall TCP SYN Cookie feature protects your firewall from TCP SYN-flooding attacks. TCP SYN-flooding attacks are a type of DoS attack. Usually, TCP SYN packets are sent to a targeted end host or a range of subnet addresses behind the firewall. These TCP SYN packets have spoofed source IP addresses. A spoofing attack is when a person or a program pretends to be another by falsifying data and thereby gaining an illegitimate advantage. The TCP SYN-flooding can take up all the resource on a firewall or an end host, thereby causing DoS to legitimate traffic. To prevent TCP SYN-flooding on a firewall and the end hosts behind the firewall, you must configure the Firewall TCP SYN Cookie feature.

        The following commands were introduced or modified: parameter-map type inspect-vrf, parameter-map type inspect-zone, parameter-map type inspect global, show policy-firewall stats, tcp syn-flood rate per-destination, tcp syn-flood limit.