2

We have an ASR1000, and I have the following ACL, but yesterday someone hit us with big DDoS attack, and I found it was a DNS amplification attack. so all source port for 53, and it was definitely a fragmentation attack. See the following NetFlow data. I saw the router blocked some of the data, but some data sneaked in. In short it hit the internal servers.

Question: Why didn't the ACL stop this attack? How does the ACL handle fragmented packets here? The first packet contains port info, but the following fragmentaed packtes are L3, so how does a firewall handle them. We have deny any any in end, too.

Netflow

Top 10 Src Port ordered by bps:
Date first seen          Duration Proto          Src Port    Flows(%)     Packets(%)       Bytes(%)         pps      bps   bpp
2016-10-26 10:06:42.898  1207.930 any                   0    64619(49.0)   68.6 M(49.8)   86.7 G(57.2)    56826  574.5 M  1263
2016-10-26 10:06:42.754  1420.227 any                  53    46718(35.4)   47.1 M(34.2)   61.8 G(40.7)    33153  348.2 M  1313

ACL

ip access-list extended FOO-ACL
 permit udp any gt 1023 object-group VOIP-NET range 12000 13000
 permit udp any gt 1023 object-group SIP-NET eq 5060 
 permit udp object-group GOOGLE-DNS any
 permit tcp host any eq bgp host X.X.X.X
 permit icmp any object-group ICMP-NET echo-reply
 permit icmp any object-group ICMP-NET net-unreachable
 permit icmp any object-group ICMP-NET host-unreachable
 permit icmp any object-group ICMP-NET port-unreachable
 permit icmp any object-group ICMP-NET ttl-exceeded
 deny   ip any any
Improve this question

1 Answer 1

Reset to default
5

You are not denying fragments. Cisco has an Access Control Lists and IP Fragments document that specifically deals with this problem.

ACLs and Fragmented Packets

ACLs have a fragments keyword that enables specialized fragmented packet-handling behavior. In general, noninitial fragments that match the Layer 3 statements (protocol, source address, and destination address)—irrespective of the Layer 4 information in an ACL—are affected by the permit or deny statement of the matched entry. Note that the use of the fragments keyword can force ACLs to either deny or permit noninitial fragments with more granularity.

Filtering fragments adds an additional layer of protection against a denial-of-service (DoS) attack that uses only noninitial fragments (such as FO > 0). The use of a deny statement for noninitial fragments at the beginning of the ACL denies all noninitial fragments from accessing the router. Under rare circumstances, a valid session might require fragmentation and therefore be filtered if a deny fragment statement exists in the ACL. Conditions that might lead to fragmentation include the use of digital certificates for ISAKMP authentication and the use of IPSec NAT Traversal.

For example, consider the partial ACL shown here.

access-list 110 deny tcp any Internet routable subnet fragments
access-list 110 deny udp any Internet routable subnet fragments
access-list 110 deny icmp any Internet routable subnet fragments
<rest of ACL>

Adding these entries to the beginning of an ACL denies any noninitial fragment access to the network, while nonfragmented packets or initial fragments pass to the next lines of the ACL unaffected by the deny fragment statements. The previous ACL snippet also facilitates classification of the attack since each protocol—UDP, TCP, and ICMP—increments separate counters in the ACL.

Since many attacks rely on flooding with fragmented packets, filtering incoming fragments to the internal network provides an added measure of protection and helps ensure that an attack cannot inject fragments by simply matching layer 3 rules in the transit ACL.

Refer to Access Control Lists and IP Fragments for a detailed discussion of the options.

Improve this answer
12
  • You are saying deny any any won't be able to stop fragmente packets, i thought if packet doesn't match to ACL then it should dropped in end.
    – Satish
    Oct 28, 2016 at 14:41
  • It doesn't drop fragments. The deny fragments should be the first line in your incoming WAN ACL.
    – Ron Maupin ♦
    Oct 28, 2016 at 14:44
  • 1
    Most businesses don't allow fragments from the Internet into their networks. You don't want to do what you have in your comment. You want to use something like the partial ACL in the text block in my answer. if you deny all TCP port 80 packets, that will block the web server. You need to block inbound fragments from the Internet.
    – Ron Maupin ♦
    Oct 28, 2016 at 15:33
  • 2
    Don't confuse TCP segmentation with IP fragments. TCP will segment its data to a size meeting the MSS, and that will fit into the payload of the IP packets, which will be sized to fit the MTU. Fragmentation happens when the MTU along the path shrinks. Today, we have PMTUD to discover the minimum MTU along the path.
    – Ron Maupin ♦
    Oct 28, 2016 at 16:13
  • 2
    @Satish: One word to the fragment keyword: "deny ip any any" of course does deny fragmented packets. Problem is, that those are permitted before. There is no layer 4 header in a non-initial fragment, hence no way for the ACL to match on port numbers. For those fragments, the specified port numbers of your existing ACLs are ignored and matching is done on IP information only. Example: for non-initial fragments, the first line of your ACL reads: "permit udp any object-group VOIP-NET". The main use case for the fragment keyword is to deny fragments only, in front of all permit statements.
    – Daniel
    Oct 29, 2016 at 4:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.