Configuring Attack Checks - Cisco WS-CE500 Administration Manual

Firewall Configuration
Using Other Tools to Prevent Attacks, Restrict Access, and Control Inbound Traffic
STEP 1
STEP 2
STEP 3
STEP 4
Cisco SA500 Series Security Appliances Administration Guide

Configuring Attack Checks

Use this page to specify how you want to protect your network against common
types of attacks including discovery, flooding, and echo storms.
Click Firewall > Attacks. The Attack Checks window opens.
In the WAN Security Checks area, check the box for each feature that you want to
enable:
• Block Ping to WAN interface: Check this box to prevent attackers from
discovering your network through ICMP Echo (ping) requests. Cisco
recommends that you uncheck this box only if you need to allow the security
appliance to respond to pings for diagnostic purposes.
This setting is overridden in these cases:
- A firewall rule that directs ping requests to a particular computer on the
LAN. See Configuring Firewall Rules to Control Inbound and
Outbound Traffic, page
- WAN Mode settings that ping specified IP addresses for failure
detection. See
Detection, page
• Enable Stealth Mode: Check this box to prevent the security appliance from
responding to port scans from the WAN. In Stealth Mode, your network is
less susceptible to discovery and attacks.
• Block TCP Flood: Check this box to drop all invalid TCP packets. This
feature protects your network from a SYN flood attack, in which an attacker
sends a succession of SYN (synchronize) requests to a target system.
In the LAN Security Checks section, check the Block UDP Flood box to prevent
the security appliance from accepting more than 25 simultaneous, active UDP
connections from a single computer on the LAN.
In the ICSA Settings area, enter the following information:
• Block ICMP Notification: Check this box to silently block without sending an
ICMP notification to the sender. Some protocols, such as MTU Path
Discovery, require ICMP notifications.
• Block Fragmented Packets: Check this box to block fragmented packets
from ANY to ANY.
• Block Multicast Packets: Check this box to block multicast packets.
103.
Configuring Auto-Rollover, Load Balancing, and Failure
57.
4
118