V-283895

Discussion

DoS events may occur due to a variety of internal and external causes, such as an attack by an adversary or a lack of planning to support organizational needs with respect to capacity and bandwidth. Such attacks can occur across a wide range of network protocols (e.g., IPv4, IPv6). A variety of technologies are available to limit or eliminate the origination and effects of DoS events. For example, boundary protection devices can filter certain types of packets to protect system components on internal networks from being directly affected by or the source of DoS attacks. Employing increased network capacity and bandwidth combined with service redundancy also reduces the susceptibility to DoS events.

Check Content

Verify the router is configured to employ organization-defined controls by type of DoS to achieve the DoS objective.

Verify CPM IP-Filter using the example below: 

- show system security cpm-filter ip-filter entry 10

CPM IP Filter Entry

Entry Id           : 10
Description        : (Not Specified)
-------------------------------------------------------------------------------
Filter Entry Match Criteria :
-------------------------------------------------------------------------------
Log Id             : n/a
Src. IP            : 192.168.1.1/32
Src. Port          : n/a
Dst. IP            : n/a
Dest. Port         : n/a
Protocol           : ospf-igp           Dscp               : Undefined
ICMP Type          : Undefined          ICMP Code          : Undefined
Fragment           : Off                Option-present     : Off
IP-Option          : n/a                Multiple Option    : Off
TCP-syn            : Off                TCP-ack            : Off
Action             : Forward
Match Router ID    : n/a
Dropped pkts       : 0                  Forwarded pkts     : 0

Verify Distributed CPU Protection using the example below: 

- show system security dist-cpu-protection policy "rate-limit" detail

Distributed CPU Protection Policy

Policy Name : rate-limit
Description : (Not Specified)
Policy Type : access-network

-------------------------------------------------------------------------------
Static Policer
-------------------------------------------------------------------------------
Static Policer      : PIM-RATE
Description         : (Not Specified)
Kbps                : 2000 kbps             MBS             : 200 KB
Detection Time      : 30 seconds
Exceed-Action       : None                  Hold-Down Time  : none
Log Events          : enable

-------------------------------------------------------------------------------
Static Policer      : ICMP-RATE
Description         : (Not Specified)
Kbps                : 2000 kbps             MBS             : 200 KB
Detection Time      : 30 seconds
Exceed-Action       : None                  Hold-Down Time  : none
Log Events          : enable

-------------------------------------------------------------------------------
Static Policer      : ALL-Other-Rate
Description         : (Not Specified)
Kbps                : 2000 kbps             MBS             : 200 KB
Detection Time      : 30 seconds
Exceed-Action       : None                  Hold-Down Time  : none
Log Events          : enable
-------------------------------------------------------------------------------

-------------------------------------------------------------------------------
Local Monitoring Policer
-------------------------------------------------------------------------------
No Matching Entries
-------------------------------------------------------------------------------

-------------------------------------------------------------------------------
Protocol (Dynamic Policer)
-------------------------------------------------------------------------------
Protocol            : icmp
Enforcement Type    : static                Enforcement Plcr: ICMP-RATE

Dynamic Policer Parameters
--------------------------
Packets             : max                   Within          : 1 seconds
Initial Delay       : none
Detection Time      : 30 seconds
Exceed-Action       : None                  Hold-Down Time  : none
Log Events          : enable

-------------------------------------------------------------------------------
Protocol            : all-unspecified
Enforcement Type    : static                Enforcement Plcr: ALL-Other-Rate

Dynamic Policer Parameters
--------------------------
Packets             : max                   Within          : 1 seconds
Initial Delay       : none
Detection Time      : 30 seconds
Exceed-Action       : None                  Hold-Down Time  : none
Log Events          : enable

-------------------------------------------------------------------------------
Protocol            : pim
Enforcement Type    : static                Enforcement Plcr: PIM-RATE

Dynamic Policer Parameters
--------------------------
Packets             : max                   Within          : 1 seconds
Initial Delay       : none
Detection Time      : 30 seconds
Exceed-Action       : None                  Hold-Down Time  : none
Log Events          : enable
-------------------------------------------------------------------------------

If the router is not configured to employ organization-defined controls by type of DoS to achieve the DoS objective, this is a finding.