The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The Firewall TCP SYN Cookie feature protects your firewall from TCP SYN-flooding attacks. TCP SYN-flooding attacks are a type of denial-of-service (DoS) attack. Usually, TCP synchronization (SYN) packets are sent to a targeted end host or a range of subnet addresses behind the firewall. These TCP SYN packets have spoofed source IP addresses. A spoofing attack is when a person or a program pretends to be another by falsifying data and thereby gaining an illegitimate advantage. TCP SYN-flooding can take up all resources on a firewall or an end host, thereby causing DoS to legitimate traffic. To prevent TCP SYN-flooding on a firewall and the end hosts behind the firewall, you must configure the Firewall TCP SYN Cookie feature.
Because a default zone does not support zone type parameter map, you cannot configure the Firewall TCP SYN Cookie feature for a default zone.
The Firewall TCP SYN Cookie feature does not support per-subscriber firewall.
The Firewall TCP SYN Cookie feature implements software to protect the firewall from TCP SYN-flooding attacks, which are a type of DoS attack.
A SYN-flooding attack occurs when a hacker floods a server with a barrage of requests for connection. Because these messages have unreachable return addresses, the connections cannot be established. The resulting volume of unresolved open connections eventually overwhelms the server and can cause it to deny service to valid requests, thereby preventing legitimate users from connecting to a website, accessing e-mail, using FTP service, and so on.
SYN flood attacks are divided into two types:
Host flood—SYN flood packets are sent to a single host aiming to utilize all resources on that host.
Firewall session table flood—SYN flood packets are sent to a range of addresses behind the firewall, with the aim of exhausting the session table resources on the firewall and thereby denying resources to the legitimate traffic going through the firewall.
The Firewall TCP SYN Cookie feature helps prevent SYN-flooding attacks by intercepting and validating TCP connection requests. The firewall intercepts TCP SYN packets that are sent from clients to servers. When the TCP SYN cookie is triggered, it acts on all SYN packets that are destined to the configured VPN Routing and Forwarding (VRF) or zone. The TCP SYN cookie establishes a connection with the client on behalf of the destination server and another connection with the server on behalf of the client and knits together the two half-connections transparently. Thus, connection attempts from unreachable hosts will never reach the server. The TCP SYN cookie intercepts and forwards packets throughout the duration of the connection.
The Firewall TCP SYN Cookie feature provides session table SYN flood protection for the global routing domain and for the VRF domain. Because the firewall saves sessions in a global table, you can configure a limit to the number of TCP half-opened sessions. A TCP half-opened session is a session that has not reached the established state. In a VRF-aware firewall, you can configure a limit to the number of TCP half-opened sessions for each VRF. At both the global level and at the VRF level, when the configured limit is reached, the TCP SYN cookie verifies the source of the half-opened sessions before creating more sessions.
TCP SYN packets are sent to a single host with the aim of taking over all resources on the host. You can configure host protection only for the source zone. Configuring protection on the destination zone will not protect the destination zone from TCP SYN attacks.
Perform this task to configure the firewall host protection.
 Note |
You can specify the show commands in any order. |
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
|
Step 2 |
configure terminal Example: |
Enters global configuration mode. |
|
Step 3 |
parameter-map type inspect-zone zone-pmap-name Example: |
Configures an inspect zone type parameter map and enters profile configuration mode. |
|
Step 4 |
tcp syn-flood rate per-destination maximum-rate Example: |
Configures the number of SYN flood packets per second for each destination address.
|
|
Step 5 |
max-destination limit Example: |
Configures the maximum number of destinations that the firewall can track for a zone.
|
|
Step 6 |
exit Example: |
Exits profile configuration mode and enters global configuration mode. |
|
Step 7 |
zone security zone-name Example: |
Configures a security zone and enters security zone configuration mode. |
|
Step 8 |
protection parameter-map-name Example: |
Configures protection for the specified zone using the parameter map. |
|
Step 9 |
exit Example: |
Exits security zone configuration and enters privileged EXEC mode. |
|
Step 10 |
show parameter-map type inspect-zone zone-pmap-name Example: |
(Optional) Displays details about the inspect zone type parameter map. |
|
Step 11 |
show zone security Example: |
(Optional) Displays zone security information. |
|
Step 12 |
show policy-firewall stats zone zone-name Example: |
(Optional) Displays how many SYN packets exceeded the packet limit and were processed by SYN cookies. |
TCP SYN packets are sent to a range of addresses behind the firewall aiming to exhaust the session table resources on the firewall, thereby denying resources to the legitimate traffic going through the firewall. You can configure firewall session table protection either for the global routing domain or for the VRF domain.
Perform this task to configure firewall session table protection for global routing domains.
Note |
A global parameter map takes effect on the global routing domain and not at the router level. |
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
|
Step 2 |
configure terminal Example: |
Enters global configuration mode. |
|
Step 3 |
parameter-map type inspect global Example: |
Configures a global parameter map and enters profile configuration mode. |
|
Step 4 |
tcp syn-flood limit number Example: |
Limits the number of TCP half-open sessions that triggers SYN cookie processing for new SYN packets. |
|
Step 5 |
end Example: |
Exits profile configuration mode and enters privileged EXEC mode. |
|
Step 6 |
show policy-firewall stats vrf global Example: |
(Optional) Displays the status of the global VRF firewall policy.
|
Perform this task to configure the firewall session table protection for VRF domains.
Note |
You can specify the show commands in any order. |
| Command or Action | Purpose | |
|---|---|---|
|
Step 1 |
enable Example: |
Enables privileged EXEC mode.
|
|
Step 2 |
configure terminal Example: |
Enters global configuration mode. |
|
Step 3 |
parameter-map type inspect-vrf vrf-pmap-name Example: |
Configures an inspect-VRF type parameter map and enters profile configuration mode. |
|
Step 4 |
tcp syn-flood limit number Example: |
Limits the number of TCP half-open sessions that triggers SYN cookie processing for new SYN packets. |
|
Step 5 |
exit Example: |
Exits profile configuration mode and enters global configuration mode. |
|
Step 6 |
parameter-map type inspect global Example: |
Binds the inspect-VRF type parameter map to a VRF and enters profile configuration mode. |
|
Step 7 |
vrf vrf-name inspect parameter-map-name Example: |
Binds the parameter map to the VRF. |
|
Step 8 |
end Example: |
Exits profile configuration mode and enters privileged EXEC mode. |
|
Step 9 |
show parameter-map type inspect-vrf Example: |
(Optional) Displays information about inspect VRF type parameter map. |
|
Step 10 |
show policy-firewall stats vrf vrf-name Example: |
(Optional) Displays the status of the VRF firewall policy.
|
The following example shows how to configure the firewall host protection:
Router(config)# parameter-map type inspect-zone zone-pmap
Router(config-profile)# tcp syn-flood rate per-destination 400
Router(config-profile)# max-destination 10000
Router(config-profile)# exit
Router(config)# zone security secure-zone
Router(config-sec-zone)# protection zone-pmap The following example shows how to configure firewall session table protection for global routing domains:
Router# configure terminal
Router(config)# parameter-map type inspect global
Router(config-profile)# tcp syn-flood limit 500
Router(config-profile)# end The following example shows how to configure firewall session table protection for VRF domains:
Router# configure terminal
Router(config)# parameter-map type inspect-vrf vrf-pmap
Router(config-profile)# tcp syn-flood limit 200
Router(config-profile)# exit
Router(config)# parameter-map type inspect global
Router(config-profile)# vrf vrf1 inspect vrf-pmap
Router(config-profile)# end |
Related Topic |
Document Title |
|---|---|
|
Cisco IOS commands |
|
|
Security commands |
|
|
Description |
Link |
|---|---|
|
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. |
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.|
Feature Name |
Releases |
Feature Information |
|---|---|---|
|
Firewall TCP SYN Cookie |
Cisco IOS XE Release 3.3S |
The Firewall TCP SYN Cookie feature protects your firewall from TCP SYN-flooding attacks. TCP SYN-flooding attacks are a type of DoS attack. Usually, TCP SYN packets are sent to a targeted end host or a range of subnet addresses behind the firewall. These TCP SYN packets have spoofed source IP addresses. A spoofing attack is when a person or a program pretends to be another by falsifying data and thereby gaining an illegitimate advantage. The TCP SYN-flooding can take up all the resource on a firewall or an end host, thereby causing DoS to legitimate traffic. To prevent TCP SYN-flooding on a firewall and the end hosts behind the firewall, you must configure the Firewall TCP SYN Cookie feature. The following commands were introduced or modified: parameter-map type inspect-vrf , parameter-map type inspect-zone , parameter-map type inspect global , show policy-firewall stats , tcp syn-flood rate per-destination , tcp syn-flood limit . |
Feedback