Users Guide

738 Access Control Lists
A Consolidated DoS Example
This example includes some ACL rules to consider to reduce DoS attacks on
the switch. It does not represent a complete DoS suite. A firewall with deep
packet inspection capabilities should be used for true DoS protection.
1 Configure an IP access list named “squelch-dos attacks”:
console#config
console(config)#ip access-list squelch-dos-attacks
2 Rate-limit echo requests:
console(config-ip-acl)#permit icmp any any icmp-message echo
rate-limit 32 64
3 Deny telnet and rate-limit SSH to the CPU:
console(config-ip-acl)#deny tcp any any eq telnet flag
established
console(config-ip-acl)#permit tcp any any eq 22 flag
established rate-limit 1024 128
console(config-ip-acl)#deny tcp any any eq telnet
console(config-ip-acl)#permit tcp any any eq 22 rate-limit 12 2
4 Rate limit TCP opens:
console(config-ip-acl)#permit tcp any any flag +syn rate-limit
8 2
5 Rate limit TCP closes:
console(config-ip-acl)#permit tcp any any flag +fin rate-limit
8 2
6 Block TCP/UDP/IP frag attacks:
console(config-ip-acl)#deny ip any any fragments
7 Limit SNMP (should set source address to management stations). Must be
tuned for SNMP walks. May need to adjust the SNMP client retry count or
timeout:
console(config-ip-acl)#permit udp any any eq snmp rate-limit
1024 128
8 Allow other traffic types to come to CPU:
console(config-ip-acl)#permit every
console(config-ip-acl)#exit
NOTE: The rate limits below should be adjusted to match the expected rates of
traffic coming to the CPU.