0

How to limit the number of established connections for each host, that connect to the service? In the policy settings, I found only blocking by the number of half open connections.

parameter-map type inspect DoS
 max-incomplete low  20
 max-incomplete high 200
 one-minute low 100
 one-minute high 1000 
 tcp max-incomplete host 5 block-time 3 
 sessions maximum 2147483647

class-map type inspect match-any IN_OUT_PROT
 match protocol tcp
 match protocol udp
 match protocol icmp
 match protocol ssh
 match protocol ftp
 match protocol tftp
class-map type inspect match-any OUT_IN_PROT
 match protocol tcp
 match protocol ssh
 match protocol ftp

policy-map type inspect IN_OUT_policy
 class type inspect IN_OUT_PROT
  inspect
 class class-default
policy-map type inspect OUT_IN_policy
 class type inspect OUT_IN_PROT
  inspect DoS
 class class-default
!
zone security IN
 description local network
zone security OUT
 description external network
zone-pair security IN_OUT source IN destination OUT
 service-policy type inspect IN_OUT_policy
zone-pair security OUT_IN source OUT destination IN
 service-policy type inspect OUT_IN_policy

interface FastEthernet0/0
 ip address 192.168.100.1 255.255.255.0
 zone-member security IN
 duplex auto
 speed auto
!
interface FastEthernet0/1
 ip address 192.168.200.1 255.255.255.0
 zone-member security OUT
 duplex auto
 speed auto
  • 2
    What are you trying to accomplish, exactly ? If the goal is to prevent DDoS, incomplete connections per host would seem a good way to do it. Randomly dropping actual correctly-established TCP sessions sounds like a great way to create application issues that will be very very hard to troubleshoot effectively. – Jeremy Gibbons Oct 21 '19 at 18:51
  • @JeremyGibbons I need to block the host, which enumerates passwords for the service. The attacker uses kali linux and hydra. In this program, you can set the number of threads to the attacked service. It must be done so that he can make 1-2 connections. – ChapeauClaque Oct 22 '19 at 3:56
  • 1
    I don't get it: why not just block them entirely ? Or handle this at the application level ? – Jeremy Gibbons Oct 22 '19 at 11:31
  • 1
    Have you looked at cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_zbf/… - policing seems to be what you need. – Zac67 Oct 22 '19 at 14:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.