User ManualTable of ContentsContents3About This Document11Audience11Supported hardware and software11Document conventions11Text formatting11Notes, cautions, and danger notices12Notice to the reader12Related publications13Getting technical help13Network Security15TCP SYN attacks15IP TCP syn-proxy15Granular application of syn-proxy feature16Syn-def16Introduction16show server traffic16SYN-def-dont-send-ack17show server debug17No response to non-SYN first packet of a TCP flow18Prioritizing management traffic19Protection against attack in hardware20Peak BP utilization with TRAP20Show CPU-utilization command enhancement20BP utilization threshold21MP utilization threshold21Transaction Rate Limit (TRL)21Understanding transaction rate limit21Configuring transaction rate limit22Configuring the maximum number of rules26Saving a TRL configuration27Transaction rate limit command reference27Global TRL28TRL plus security ACL-ID29security acl-id29Transaction rate limit hold-down value29Displaying TRL rules statistics29Displaying TRL rules in a policy29Displaying IP address with held down traffic30Refusing new connections from a specified IP address30HTTP TRL31Overview of HTTP TRL31HTTP TRL features31Configuring HTTP TRL32Configuring HTTP TRL client32Configuring HTTP TRL defaults33Sample HTTP TRL configuration34Displaying HTTP TRL35Display all HTTP TRL policies36Display HTTP TRL policy from index36Display HTTP TRL policy client37Display HTTP TRL policy starting from index37Display HTTP TRL policy matching a regular expression38Display HTTP TRL policy client index (MP)38Display HTTP TRL policy client index (BP)39Display HTTP TRL policy for all client entries (BP)40Downloading an HTTP TRL policy through TFTP40HTTP TRL policy commands41Client-name <client-name> monitor-interval41Client-name <client-name> max-conn41Client-name <client-name> exceed-action42Default monitor-interval42Default max-conn43Default exceed-action43Logging for DoS Attacks44Configuration commands44show server conn-rate45Maximum connections45clear statistics dos-attack45Maximum concurrent connection limit per client46Limiting the number of concurrent connections per client46Firewall load balancing enhancements48Enabling firewall strict forwarding48Enabling firewall VRRPE priority48Enabling track firewall group49Enabling firewall session sync delay49Syn-cookie threshhold trap49Service port attack protection in hardware49Traffic segmentation50VLAN bridging50Considerations when configuring VLAN bridging52Configuring VLAN bridging52Displaying VLAN bridge information53Traffic segmentation using the use-session-for-vip-mac command55DNS attack protection56Notes:56Configuring DNS attack protection57Displaying DNS attack protection information60Access Control List63How ServerIron processes ACLs63Prior to release 12.3.0163Beginning with release 12.3.01 and later63Rule-based ACLs64How fragmented packets are processed65Default ACL action65Types of IP ACLs66ACL IDs and entries66ACL entries and the Layer 4 CAM67Aging out of entries in the Layer 4 CAM67Displaying the number of Layer 4 CAM entries67Specifying the maximum number of CAM entries for rule-based ACLs68Configuring numbered and named ACLs68Configuring standard numbered ACLs69Configuring extended numbered ACLs70Extended ACL syntax72Configuring standard or extended named ACLs76Displaying ACL definitions77Displaying ACLs using keywords78Modifying ACLs81Displaying a list of ACL entries82Applying an ACLs to interfaces83Reapplying modified ACLs83ACL logging84Displaying ACL log entries85Displaying ACL statistics for flow-based ACLs86Clearing flow-based ACL statistics86Dropping all fragments that exactly match a flow-based ACL86Clearing the ACL statistics87Enabling ACL filtering of fragmented packets87Filtering fragmented packets for rule-based ACLs87Enabling hardware filtering for packets denied by flow-based ACLs89Enabling strict TCP or UDP mode for flow-based ACLs90Enabling strict TCP mode90Enabling strict UDP mode91Configuring ACL packet and flow counters92ACLs and ICMP93Using flow-based ACLs to filter ICMP packets based on the IP packet length93ICMP filtering with flow-based ACLs93Using ACLs and NAT on the same interface (flow-based ACLs)96Displaying ACL bindings97Troubleshooting rule-based ACLs97IPv6 Access Control Lists99IACL overview99Configuration Notes100Processing of IPv6 ACLs100Configuring an IPv6 ACL101Applying an IPv6 ACL to an interface107Displaying ACLs108Displaying ACLs bound to an interface108Using an ACL to Restrict SSH Access108Using an ACL to Restrict Telnet Access109Logging IPv6 ACLs109Network Address Translation111Introduction111Configuring NAT111Configuring static NAT112Configuring dynamic NAT112NAT configuration examples113PAT117Forwarding packets without NAT translation117Translation timeouts118Configuring the NAT translation aging timer118Stateless static IP NAT119Redundancy119Enabling IP NAT120Enabling static NAT redundancy120Enabling dynamic NAT redundancy121Displaying NAT information121Displaying NAT statistics122Displaying NAT translation124Displaying NAT redundancy information125Displaying VRRPE information126Clearing NAT entries from the table126Syn-Proxy and DoS Protection127Understanding Syn-Proxy127Syn-Proxy auto control127Difference between ServerIron ADX and JetCore Syn-Proxy Behavior127Configuring Syn-Proxy128Setting a minimum MSS value for SYN-ACK packets131Configuring Syn-Proxy auto control134Displaying Syn-Proxy Commands135DDoS protection138Configuring a security filter139Configuring a Generic Rule139Configuring a rule for common attack types141Configuring a rule for ip-option attack types143Configuring a rule for icmp-type options144Configuring a rule for IPv6 ICMP types145Configuring a rule for IPv6 ext header types146Binding the filter to an interface147Clearing DOS attack statistics147Clearing all DDOS Filter & Attack Counters147Logging for DoS attacks147Displaying security filter statistics148Address-sweep and port-scan logging148Secure Socket Layer (SSL) Acceleration149SSL overview149Public Key Infrastructure (PKI)149Asymmetric cryptography150Certificate Authority (CA)150Certificate Revocation List (CRL)150Cipher suite150Digital certificate150Digital signature150Key150Key pair150Private key150Public key151SSL acceleration on the ServerIron ADX151SSL Termination Mode151SSL Proxy Mode152ServerIron ADX SSL152Configuring SSL on a ServerIron ADX154Obtaining a ServerIron ADX keypair file154Certificate management155Converting certificate formats161Importing keys and certificates162Support for SSL renegotiation178Basic SSL profile configuration178Specifying a keypair file179Specifying a cipher suite179Specifying a certificate file180Advanced SSL profile configuration180Configuring client authentication180Enabling session caching184Configuring session cache size184Configuring a session cache timeout185Enabling SSL Version 2185Enabling close notify185Disabling certificate verification185Enabling a ServerIron ADX SSL to respond with renegotiation headers186Configuring Real and Virtual Servers for SSL Termination and Proxy Mode186Configuring Real and Virtual Servers for SSL Termination Mode187Configuring Real and Virtual Servers for SSL Proxy Mode188Configuration Examples for SSL Termination and Proxy Modes190Configuring SSL Termination Mode190Configuring SSL Proxy Mode191TCP configuration issues with SSL Terminate and SSL Proxy192Other protocols supported for SSL198Configuring the system max values199SSL debug and troubleshooting commands201Diagnostics201Displaying SSL information202Displaying the status of a CRL record205Displaying socket information213Displaying SSL Statistics information215Displaying TCP IP information219ASM SSL dump commands223Size: 1.65 MBPages: 226Language: EnglishOpen manual
