Prevention Of Security Zones Using Denial Of Service Attacks - Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING SCREENOS DEVICES GUIDE REV 01 Manual

Table 19: TCP/IP Setting Options
TCP Setting Options
SYN Fragment Detection
Drop Packet without TCP Flags
Set
Block SYN with FIN TCP
Segments
Block FIN without ACK TCP
Segments
Drop Packets with an Unknown
Protocol
Related
Documentation

Prevention of Security Zones Using Denial of Service Attacks

Table 20: Security Zones Prevention using DoS
Security Zones Setting
Options
Ping of Death Attack Protection
Copyright © 2010, Juniper Networks, Inc.
Your Action
Select this option to detect TCP fragments that contain a SYN flag. A SYN flag in TCP segment
initiates a connection but does not usually contain a payload. Because the packet is small, it
should not be fragmented.
Select this option to detect TCP segment headers that do not have at least one flag control
set.
Select this option to detect packets in which both the SYN and FIN flags are set. The SYN flag
synchronizes sequence numbers to initiate a TCP connection and the FIN flag indicates the
end of data transmission to finish a TCP connection, so both flags should never be set in the
same packet.
Select this option to detect packets in which the FIN flag is set, but the ACK flag is not. The
FIN flag signals the conclusion of a session and terminates the connection; normally the ACK
flag is also set to acknowledge the previous packet received.
Select this option to drop packets in which the protocol field is set to 101 or greater. Protocol
types 101 and higher are currently reserved and undefined.
Prevention of Security Zones Using Denial of Service Attacks on page 47
Malicious URL Protection on page 49
Example: Enabling the Malicious URL Blocking Option (NSM Procedure) on page 50
Attackers use denial-of-service (DoS) attacks to overwhelm a target with traffic from a
single source IP, preventing the target from processing legitimate traffic. A more advance
version of a DoS attack is a distributed DoS (DDoS) attack, in which attackers use multiple
source addresses. Typically, attackers use a spoofed IP address or a previously
compromised IP address as the source address to avoid detection.
To protect targets in the security zone from DoS and DDoS attacks, configure the settings
as described in Table 20 on page 47.
Your Action
Select this option to reject oversized and irregular ICMP packets. Attackers might send a
maliciously crafted ping (ICMP packet) that is larger than the allowed size of 65,507 bytes
to cause a DoS.
Chapter 3: Network Settings
47