Chapter 21 Configuring Advanced Connection Features; Configuring Connection Limits And Timeouts - Cisco 7604 Configuration Manual

Configuring Advanced Connection Features
This chapter describes how to customize connection features, and includes the following sections:
•
•
•
•
•
•
•

Configuring Connection Limits and Timeouts

This section describes how to set maximum TCP and UDP connections, the maximum connection rate,
connection timeouts, and how to disable TCP sequence randomization.
Each TCP connection has two ISNs: one generated by the client and one generated by the server. The
FWSM randomizes the ISN of the TCP SYN passing in both the inbound and outbound directions.
Randomizing the ISN of the protected host prevents an attacker from predicting the next ISN for a new
connection and potentially hijacking the new session.
TCP initial sequence number randomization can be disabled if required. For example:
•
•
•
Note Because of the way TCP sequence randomization is implemented, if you enable Xlate Bypass (see the
"Configuring Xlate Bypass" section on page
works for control connections, and not data connections; for data connections, the TCP sequence
continues to be randomized.
You can also configure maximum connections and TCP sequence randomization in the NAT
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
Configuring Connection Limits and Timeouts, page 21-1
Permitting or Denying Application Types with PISA Integration, page 21-4
Configuring TCP State Bypass, page 21-10
Disabling TCP Normalization, page 21-14
Preventing IP Spoofing, page 21-14
Configuring the Fragment Size, page 21-15
Blocking Unwanted Connections, page 21-15
If another in-line firewall is also randomizing the initial sequence numbers, there is no need for both
firewalls to be performing this action, even though this action does not affect the traffic.
If you use eBGP multi-hop through the FWSM, and the eBGP peers are using MD5. Randomization
breaks the MD5 checksum.
You use a WAAS device that requires the FWSM not to randomize the sequence numbers of
connections.
C H A P T E R
16-19), then disabling TCP sequence randomization only
21
21-1