Hardening Cisco Routers Against TCP SYN Flood Attacks
Upgrade to at least IOS 11.2(4)
Prevent transmission of invalid IP addresses
Let's say your network is 172.16.0.0,
and your outbound interface is serial 0/1.
Set up your access list like the following
to prevent transmitting any invalid IP addresses:
access-list 111 permit 172.16.0.0 0.0.255.255 any
access-list 111 deny ip any any log
interface serial 0/1
ip access-group 111 out
Prevent reception of invalid IP addresses
This assumes that you're an ISP or you have that
function within your organization.
Organizations A and B below are either your customers,
or groups within your larger organization.
Let's say that:
-
Your customer A,B interface is serial 1/0.
-
Customer A networks are 192.168.0.0 - 192.168.15.0.
-
Customer B networks are 172.18.0.0.
Set up your access list like the following
to prevent receiving any invalid IP addresses:
access-list 111 permit ip 192.168.0.0 0.0.15.255 any
access-list 111 permit ip 172.18.0.0 0.0.255.255 any
access-list 111 deny ip any any log
interface serial 1/0
ip access-group 111 in
For more information, see:
http://www.cisco.com/
