A distributed denial-of-service (DDoS) attack is caused when multiple malicious systems flood the targeted system with messages in the intention of exhausting the memory of the targeted system. This causes the affected system to run out of sufficient resources to service requests from legitimate peers. Attackers targeting a system can employ any of the following methods:

• Send large amounts of IKE_SA_INIT messages (but no IKE_Auth) for which half-open IKE SA structures are created. This causes the system to utilize resources and run out of memory.

• Send a large amount of junk IKE_Auth packets with correct SPI_i and SPI_r. This causes the system to run out of memory while trying to decrypt the packets.

• Provide an illegitimate URL with a certificate of large size.

• Send continuous SA_INIT packets. This causes the system to run out of memory while trying to generate keys for encrypted packets.

• Send large amounts of rekey requests per second.

• Send large amounts of messages with distinct message IDs. This causes the system to queue all incoming IKE messages, and run out of memory.

This feature provides mechanisms to defend against the DDoS attacks outlined above.

The following prevention mechanisms are available on IPSec against DDoS:

• Half-open IKE SA timeout – When an IKE_SA_INIT request is received, a half-open IKE SA timer starts. If an IKE_AUTH message is not received before the timer expires, the half-open IKEv2 IKE SA is cleared. The timer value can be configured using the ikev2-ikesa ddos half-open-sa-timer command under the Crypto Template Configuration Mode.

• Consecutive IKE_AUTH decryption failure detection – During session creation, if IKE_AUTH decryption fails consecutively for a specified number of times, the IKEv2 IKE SA is cleared. The number of consecutive failure count can be configured using the ikev2-ikesa ddos decrypt-fail-count command under the Crypto Template Configuration Mode.

  Alarms will be triggered if decryption fails during post message creation.

• Certificate validation while downloading – Downloading large certificates from illegitimate URLs can be avoided by defining the maximum certificate size for the IKE SA. The maximum certificate size can be configured using the ikev2-ikesa ddos max-cert-size command under the Crypto Template Configuration Mode.

• Limit on Child SA re-key per second – When the specified number of Child SA rekey requests per second is exceeded, TEMPORARY_FAILURE notifications will be sent to the peer to indicate that the peer must slow down their requests. The maximum Child SA re-key request per second can be configured using the ikev2-ikesa ddos rekey-rate command under the Crypto Template Configuration Mode.

• Limit on IKE messages per IKE SA – When the incoming queued IKE messages per IKE SA exceeds the specified limit, the IKE messages exceeding the limit are dropped. The limit for the IKE messages per IKE SA can be configured using the ikev2-ikesa ddos message-queue-size under the Crypto Template Configuration Mode.

For more information on the ikev2-ikesa ddos command, refer Configuring IKEv2 Protection Against DDoS of this chapter.

This feature complies with the following standards:

• RFC 7296 – Internet Key Exchange Protocol Version 2 (IKEv2) (for handling DoS attacks)

• IETF reference – "Protecting Internet Key Exchange Protocol version 2 (IKEv2), Implementations from Distributed Denial of Service Attacks"

Use the following configuration to set the half-open IKE SA timeout duration:

config 
    context context_name 
        crypto template template_name ikev2-dynamic 
            ikev2-ikesa ddos half-open-sa-timer half_open_timer_duration 
            end 

Notes:

• half_open_timer_duration must be an integer between 1 and 1800.

• Default: 60 seconds

• Use the default ikev2-ikesa ddos half-open-sa-timer command to restore the configuration to its default value.

• Use the no ikev2-ikesa ddos half-open-sa-timer command to disable a previously enabled configuration.

Use the following configuration to set the maximum tolerable consecutive IKE_AUTH decryption failure count:

config 
    context context_name 
        crypto template template_name ikev2-dynamic 
            ikev2-ikesa ddos decrypt-fail-count failure_count 
            end 

Notes:

• failure_count must be an integer between 1 and 100.

• Default: 30 times

• Use the default ikev2-ikesa ddos decrypt-fail-count keyword to restore the configuration to its default value.

• Use the no ikev2-ikesa ddos decrypt-fail-count keyword to disable a previously enabled configuration.

Use the following configuration to set the maximum number of Child SA rekey requests per second:

config 
    context context_name 
        crypto template template_name ikev2-dynamic 
            ikev2-ikesa ddos rekey-rate rekey_rate_value 
            end 

Notes:

• rekey_rate_value must be an integer between 1 and 50.

• Default: 5

• Use the default ikev2-ikesa ddos rekey-rate keyword to restore the configuration to its default value.

• Use the no ikev2-ikesa ddos rekey-rate keyword to disable a previously enabled configuration.

Use the following configuration to set the queue size for incoming IKE messages per IKE SA:

config 
    context context_name 
        crypto template template_name ikev2-dynamic 
            ikev2-ikesa ddos message-queue-size queue_size 
            end 

Notes:

• queue_size must be an integer between 1 and 50.

• Default: 20

• Use the default ikev2-ikesa ddos message-queue-size keyword to restore the configuration to its default value.

• Use the no ikev2-ikesa ddos message-queue-size keyword to disable a previously enabled configuration.

Use the following configuration to set the maximum certificate size for IKE SA:

config 
    context context_name 
        crypto template template_name ikev2-dynamic 
            ikev2-ikesa ddos max-cert-size cert_size 
            end 

Notes:

• cert_size must be an integer between 512 and 8192.

• Default: 2048 bytes

• Use the default ikev2-ikesa ddos max-cert-size keyword to restore the configuration to its default value.

• Use the no ikev2-ikesa ddos max-cert-size keyword to disable a previously enabled configuration.

The following bulks statistics included in the System schema support this feature:

DoS Cookie Challenge

An IPSecMgr IKEv2 DOS Attack alarm is generated when the high or low threshold is reached for DOS cookie challenge. The alarm is triggered when the configured DOS cookie challenge reaches the high threshold limit (system is under attack). This alarm is an indication of a security threat. The alarm is cleared when the configured DOS cookie challenge reaches the low threshold limit (system is out of attack).

IKE_Auth Decryption Failure

An IPSecMgr Decryption Failure alarm is generated when the high or low threshold is reached for IKE_Auth decryption failure. The alarm is triggered when the configured decryption failure count is reached. The alarm is cleared when the IKEv2 message from the peer is decrypted successfully, or if the session is cleared.

The following traps are available to track status and conditions relating to DDoS attack:

• starIKEv2DOSAttack: An ipsecmgr facility is under DDOS attack.

• starIKEv2ClearDOSAttack: An ipsecmgr facility is out of DDOS attack.

The following traps are available to track status and conditions relating to decryption failure:

• starIKEv2DecryptionFailThreshold: The decryption fail count for subsequent IKEV2 messages from a UE exceeds the configured value.

• starIKEv2ClearDecryptionFailThreshold: The UE sends a valid IKEv2 packet for which decryption passes.