1

We are getting many IP Fragmentation attack. Our server only dealing with UDP RTP traffic so i wonder can we set don't fragment configuration so switch or cisco router port drop all packet instead of sending them to Server and server get overload to reassemble them.

I know IP Fragmentation is very important but in our case we are only handling RTP UDP traffic and packet size is very small.. so i doubt we need IP Fragmentation feature.

2
  • 1
    Do you have a firewall? What kind of Cisco router? If the attack sources are few, I would block them entirely. If you block fragments, they will likely try another attack.
    – Ron Trunk
    Nov 26, 2015 at 18:27
  • We don't have metal firewall but we are using iptables on servers. its not a single source, its DDoS so random spoofed source addresses. I just want to say Don't Fragment on Router or switch.. is it possible?
    – Satish
    Nov 27, 2015 at 17:00

3 Answers 3

2

On the external interface of your router, use this ACL:

access-list extended NO_FRAG
deny ip any any fragments
permit ip any any
end

interface <ext interface>
ip access-group NO_FRAG in
1

You can use an inbound ACL to block fragments. The following link is a good place to start: http://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/8014-acl-wp.html

1

"Configure ASA to drop any IP fragments it receives as follows:

ASA# conf t
ASA(config)# fragment chain 1
ASA(config)# exit

Caution: Please note that this can be configured globally only, so it will affect all user traffic passing across the ASA, not only traffic specifically directed toward the Cisco ASA CX module. This configuration will result in all IP fragments being dropped by the ASA, even if this traffic will not be handled by the ASA CX module."

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170125-cas?emailclick=CNSemail

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.