Security
Denial of Service Prevention
Cisco 350XG & 550XG Series 10G Stackable Managed Switches
434
19
Default Configuration
The DoS Prevention feature has the following defaults:
•
The DoS Prevention feature is disabled by default.
•
SYN-FIN protection is enabled by default (even if DoS Prevention is
disabled).
•
If SYN protection is enabled, the default protection mode is
Block and
Report
. The default threshold is 30 SYN packets per second.
•
All other DoS Prevention features are disabled by default.
Security Suite Settings
NOTE
Before activating DoS Prevention, you must unbind all Access Control Lists (ACLs)
or advanced QoS policies that are bound to a port. ACL and advanced QoS policies
are not active when a port has DoS Protection enabled on it.
To configure DoS Prevention global settings and monitor SCT:
STEP 1
Click
Security
>
Denial of Service Prevention
>
Security Suite Settings
.
CPU Protection Mechanism: Enabled
indicates that SCT is enabled.
STEP 2
Click Details beside
CPU Utilization
page and view
CPU resource utilization information.
STEP 3
Click
Edit
beside
TCP SYN Protection
to set the feature.
STEP 4
Select
DoS Prevention
to enable the feature.
•
Disable
—Disable the feature.
•
System-Level Prevention
—Enable that part of the feature that prevents
attacks from Stacheldraht Distribution, Invasor Trojan, and Back Orifice
Trojan.
•
System-Level and Interface-Level Prevention
—Enable that part of the
feature that prevents attacks from Stacheldraht Distribution, Invasor Trojan,
and Back Orifice Trojan.
STEP 5
If System-Level Prevention or System-Level and Interface-Level Prevention is
selected, enable one or more of the following DoS Prevention options:
•
Stacheldraht Distribution
—Discards TCP packets with source TCP port
equal to 16660.
