We have an
ASR1000, and I have the following ACL, but yesterday someone hit us with big DDoS attack, and I found it was a
DNS amplification attack. so all source port for
53, and it was definitely a fragmentation attack. See the following NetFlow data. I saw the router blocked some of the data, but some data sneaked in. In short it hit the internal servers.
Question: Why didn't the ACL stop this attack? How does the ACL handle fragmented packets here? The first packet contains port info, but the following fragmentaed packtes are
L3, so how does a firewall handle them. We have
deny any any in end, too.
Top 10 Src Port ordered by bps: Date first seen Duration Proto Src Port Flows(%) Packets(%) Bytes(%) pps bps bpp 2016-10-26 10:06:42.898 1207.930 any 0 64619(49.0) 68.6 M(49.8) 86.7 G(57.2) 56826 574.5 M 1263 2016-10-26 10:06:42.754 1420.227 any 53 46718(35.4) 47.1 M(34.2) 61.8 G(40.7) 33153 348.2 M 1313
ip access-list extended FOO-ACL permit udp any gt 1023 object-group VOIP-NET range 12000 13000 permit udp any gt 1023 object-group SIP-NET eq 5060 permit udp object-group GOOGLE-DNS any permit tcp host any eq bgp host X.X.X.X permit icmp any object-group ICMP-NET echo-reply permit icmp any object-group ICMP-NET net-unreachable permit icmp any object-group ICMP-NET host-unreachable permit icmp any object-group ICMP-NET port-unreachable permit icmp any object-group ICMP-NET ttl-exceeded deny ip any any