Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
We are getting many IP Fragmentation attack. Our server only dealing with UDP RTP traffic so i wonder can we set don't fragment configuration so switch or cisco router port drop all packet instead of sending them to Server and server get overload to reassemble them.
I know IP Fragmentation is very important but in our case we are only handling RTP UDP traffic and packet size is very small.. so i doubt we need IP Fragmentation feature.
On the external interface of your router, use this ACL:
access-list extended NO_FRAG
deny ip any any fragments
permit ip any any
end
interface <ext interface>
ip access-group NO_FRAG in
You can use an inbound ACL to block fragments. The following link is a good place to start: http://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/8014-acl-wp.html
"Configure ASA to drop any IP fragments it receives as follows:
ASA# conf t
ASA(config)# fragment chain 1
ASA(config)# exit
Caution: Please note that this can be configured globally only, so it will affect all user traffic passing across the ASA, not only traffic specifically directed toward the Cisco ASA CX module. This configuration will result in all IP fragments being dropped by the ASA, even if this traffic will not be handled by the ASA CX module."
iptableson servers. its not a single source, its DDoS so random spoofed source addresses. I just want to sayDon't Fragmenton Router or switch.. is it possible?