Configuration Guide User guide

1924 FastIron Configuration Guide
53-1002494-02
TCP SYN attacks
For example, to set threshold values for TCP SYN packets targeted at the router, enter the following
command in global CONFIG mode.
Brocade(config)#ip tcp burst-normal 10 burst-max 100 lockup 300
To set threshold values for TCP SYN packets received on interface 3/11, enter the following
commands.
Brocade(config)#interface ethernet 3/11
Brocade(config-if-e1000-3/11)#ip tcp burst-normal 10 burst-max 100 lockup 300
For Layer 3 router code, if the interface is part of a VLAN that has a router VE, you must configure
TCP/SYN attack protection at the VE level. Otherwise, you can configure this feature at the
interface level as shown in the previous example. WhenTCP/SYN attack protection is configured at
the VE level, it will apply to routed traffic only. It will not affect switched traffic.
NOTE
You must configure VLAN information for the port before configuring TCP/SYN attack protection. You
cannot change the VLAN configuration for a port on which TCP/SYN attack protection is enabled.
To set threshold values for TCP/SYN packets received on VE 31, enter commands such as the
following.
Brocade(config)#interface ve 31
Brocade(config-vif-31)#ip tcp burst-normal 5000 burst-max 10000 lockup 300
Syntax: ip tcp burst-normal <value> burst-max <value> lockup <seconds>
NOTE
This command is available at the global CONFIG level on both Chassis devices and Compact devices.
On Chassis devices, this command is available at the Interface level as well. This command is
supported on Ethernet and Layer 3 interfaces.
The burst-normal <value> parameter can be from 1 – 100,000 packets per second.
The burst-max <value> parameter can be from 1 – 100,000 packets per second.
The lockup <value> parameter can be from 1 – 10,000 seconds.
The number of incoming TCP SYN packets per second is measured and compared to the threshold
values as follows:
• If the number of TCP SYN packets exceeds the burst-normal value, the excess TCP SYN packets
are dropped.
• If the number of TCP SYN packets exceeds the burst-max value, all TCP SYN packets are
dropped for the number of seconds specified by the lockup value. When the lockup period
expires, the packet counter is reset and measurement is restarted.
In the example, if the number of TCP SYN packets received per second exceeds 10, the excess
packets are dropped. If the number of TCP SYN packets received per second exceeds 100, the
device drops all TCP SYN packets for the next 300 seconds (5 minutes).