Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Reg. blocks for database size in Frag guard of PIX

Dear Team

I need to enable frag guard in PIX Firewall however i am not understanding the concept of database size in it

The following is mentioned in the Cisco pdf regarding the same however i have not understood the "block" concept

Setting the database-limit of the size option to a large value can make the PIX Firewall more vulnerable to a DoS attack by fragment flooding. Do not set the database-limit equal to or greater than the total number of blocks in the 1550 or 16384 pool

Also my current setting is default i.e 200.Please recommend if should lower this value or not


Community Member

Re: Reg. blocks for database size in Frag guard of PIX

FragGuard and virtual reassembly is a feature that provides IP fragment protection. This feature performs full reassembly of all ICMP error messages and virtual reassembly of the remaining IP fragments that are routed through the PIX Firewall. Virtual reassembly is currently enabled by default. This feature uses syslog to log any fragment overlapping and small fragment offset anomalies, especially those caused by a teardrop attack.The sysopt commands let you tune various PIX Firewall security and configuration features. In addition, you can use this command to disable the PIX Firewall IP Frag Guard feature. It is fine to use the default setting on 200 and this will work fine.

CreatePlease to create content