Siemens RUGGEDCOM ROX II, Руководство пользователя

Страница: 232 / 798

Chapter 6
Security
RUGGEDCOM ROX II
CLI User Guide
186 Protecting Against a SYN Flood Attack
Port forwarding can also remap port numbers. The second host may also need to answer http requests. As
connections to port 80 are directed to the first host, another port number (such as 8080) can be dedicated to the
second host. As requests arrive at the gateway for port 8080, the gateway remaps the port number to 80 and
forwards the request to the second host.
Port forwarding also takes the source address into account. Another way to solve the above problem could be
to dedicate two hosts 200.0.0.1 and 200.0.0.2 and have the NAT gateway forward requests on port 80 from
200.0.0.1 to 192.168.1.10 and from 200.0.0.2 to 192.168.1.20.
Section 6.9.1.5
Protecting Against a SYN Flood Attack
RUGGEDCOM ROX II responds to SYN packets according to the TCP standard by replying with a SYN-ACK packet for
open ports and an RST packet for closed ports. If the device is flooded by a high frequency of SYN packets, the port
being flooded may become unresponsive.
To prevent SYN flood attacks on closed ports, set the firewall to block all traffic to closed ports. This prevents SYN
packets from reaching the kernel.
Siemens also recommends setting the listen ports to include IP addresses on separate interfaces. For example, set
the device to listen to an IP address on switch.0001 and fe-cm-1. This will make sure that one port is accessible if
the other is flooded.
Section 6.9.1.6
Protecting Against IP Spoofing
IP spoofing is a technique where IP packets are created with a false source IP address, with the intent of concealing
the identity of the sender or impersonating a trusted host. As a result, unauthorized users can gain access to a
network.
In RUGGEDCOM ROX II, IP spoofing can be prevented by enabling the
routefilter
and
logmartians
for the
firewall interface.
For information about enabling
routefilter
and
logmartians
, refer to Section 6.9.10.2, “Adding an
Interface” .
Section 6.9.2
Viewing a List of Firewalls
To view a list of firewalls, type:
show
running-config security firewall fwconfig
If firewalls have been configured, a table or list similar to the following example appears:
ruggedcom# show running-config security firewall fwconfig
security
firewall
fwconfig firewall1
!
fwconfig firewall2
!
!
!