How could one mitigate SYN FLOOD DOS on Catalyst 3750/3560 as it has no control plane protection?


3750 does have some internally priority on what it prefers to punt when congested, but it's not configurable.

So you should rely on common best practices, that is on all your network edges you should have iACL (infrastructure ACL). In iACL you'd allow UDP highports, ICMP to infrastructure network addresses and drop rest. This way ping and traceroute work, but infrastructure cannot be attacked.
iACL should be complemented by policing the allowed traffic to small acceptable rates.

This way when external party is attacking addresses on your 3750, it'll be dropped by network border in the edge.

iACL usually is 100% static so it's low maintenance, as it'll only include infrastructure addresses (loopback, core links).

This will still leave wide open cases where your router is facing customer LAN directly, like when LAN is and 3750 has then usually would not be covered by iACL and can be attacked.
Solution for those devices is either to invest on device with proper CoPP capabilities or maintain dynamic iACL always adding the router's customer facing address there.

If you only face customers via link-networks (/30 or /31) solution is much cleaner, you just omit advertising the link-network and add static /32 route for the CPE side, this way external to this router parties cannot attack the router, as they won't have route.
Alternative solution to same issue is to use non-continuous ACL entry in iACL, if your CPE link-network is in iACL you could do 'deny ip any' then all the even addresses would be allowed and odd addresses denied, so if CPE is even and 3750 is odd, all current and future links are protected without updating iACL.

  • 1
    Pretty sure you meant Aug 13 '13 at 7:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.