You can configure the sensor to reassemble a datagram that has been fragmented over multiple packets. You can specify boundaries that the sensor uses to determine how many datagram fragments it reassembles and how long to wait for more fragments of a datagram. The goal is to ensure that the sensor does not allocate all its resources to datagrams that cannot be completely reassembled, either because the sensor missed some frame transmissions or because an attack has been launched that is based on generating random fragmented datagrams.
Do you know if the IDSM performs fragment reassembly and tcp normalization even if the signatures in the Normalizer Engine are disabled? In the IDM GUI under Signature Definition > Miscellaneous are "Fragment Reassembly" and "Stream Reassembly." Are these actions enabled at all times? Is there a way to disable those features?
I had put the IDSM-2 in-line and quite a number of users (not all) were unable to connect to our HTTPS websites. As soon as I moved the IDSM-2 back to promiscuous mode all of the affected users were able to connect again. I suspected that the normalization actions of the IDSM-2 were the culprit and I want to put the put the unit back in-line so I can at least have the benefit of in-line blocking/dropping.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...