HP VPN Firewall Appliances Access Control Configuration Guide

126
Configuring virtual fragment reassembly
Overview
To prevent service modules (such as IPSec, NAT and firewall) from processing packet fragments that
arrive out of order, you can enable the virtual fragment reassembly feature. This feature can virtually
reassemble the fragments of a datagram through fragment checking, sequencing and caching so as to
make sure fragments arrive at service modules in order.
The virtual fragment reassembly feature can also detect the following types of fragment attacks, and
discard the attack fragments for security.
• Tiny fragment attack: If the first fragment of a datagram is very small and the transport layer
protocol (such as TCP and UDP) header is in the second fragment, a tiny fragment attack is
considered.
• Overlapping fragment attack: If two consecutive incoming fragments are identical or overlapping,
an overlapping fragment attack is considered.
• Fragment-flood attack: If the maximum number of fragments per datagram or the maximum number
of fragment queues on the device is reached, a fragment-flood attack is considered.
NOTE:
The virtual fra
g
ment reassembly feature does not support load sharin
g
, and the fra
g
ments of an IP packe
t
from different security zones cannot be reassembled.
Configuring virtual fragment reassembly in the Web interface
Configuration procedure
1. Select Firewall > Session Table > Advanced from the navigation tree.