Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Protecting the Network

heres my setup:

I have a ROUTED access layer switch and a user vlan that terminates on it. The default gateway for the users is the user-vlan interface on the switch.

The problem is that the users need to be treated as untrusted users. Their traffic needs to be firewalled, per se. We dont have a FW appliance, so we have to resort to ACLs.

the users will need access to a few servers on our server farm. That leaves us vulnerable to DoS attacks and hacking.

Now, we can block ICMP but we dont want to -- want it for t-shooting.

Is there a way to allow pings from the users to the servers BUT limit them so that they cannot launch a DoS attack?

Thanks

5 REPLIES
VIP Super Bronze
New Member

Re: Protecting the Network

Hi, thanks...Theyre nice docs, but not really what I need...

Is it possible to allow icmp pings to traverse an interface (inbound), but only in a limited fashion? I know theres rate limiting, but, believe it or not, the 7600 does not support it...pretty amazed at that one.

Anyway, I dont even want that. I want to limit based on the number of packets. So, if someone pings a server with 10000 pings to create a DoS, i want the router to allow, say, 100, and block the rest.

Does this exist??

Hall of Fame Super Silver

Re: Protecting the Network

The 7600 supports rate limiting. See, for instance, the following document section: http://www.cisco.com/en/US/docs/routers/7600/ios/12.2SR/configuration/guide/dos.html#wp1140968

It describes QoS rate limiting and appears to be just what you are asking about.

Hope this helps.

New Member

Re: Protecting the Network

Thanks for that excellent doc. I am going to review it closely.

When i said the 7600 doe snot support rate limiting, i should have been more specific. It doesnt support interface-based rate limiting.

int te6/2

rate-limit bla bla bla.... That doesnt exist as an option.

Again, though, I am looking for a rate limiting mechanism that can operate on the PACKET level, not CIR or burst. In other words, allow 10 pings in a row from one source and kill the rest....or something like that...

Thanks

Cisco Employee

Re: Protecting the Network

Hi,

Try VLAN based QoS. The below link will give you an idea of how to configure the same,

http://www.cisco.com/en/US/products/hw/switches/ps700/products_tech_note09186a00801c8c4b.shtml

HTH,

Nagendra

157
Views
9
Helpful
5
Replies