Cisco Cisco Packet Data Interworking Function (PDIF) Guía Para Resolver Problemas
Active Charging Service Configuration Mode Commands
firewall tcp-syn-flood-intercept ▀
Cisco ASR 5000 Series Command Line Interface Reference ▄
OL-22948-01
firewall tcp-syn-flood-intercept
This command enables and configures the TCP intercept parameters to prevent TCP-SYN flooding attacks by
intercepting and validating TCP connection requests for DoS protection mechanism configured with the
intercepting and validating TCP connection requests for DoS protection mechanism configured with the
command.
Important:
In StarOS 8.1 and later, for Rulebase-based Stateful Firewall this command is available in the
Rulebase Configuration Mode, and for Policy-based Stateful Firewall in the Firewall-and-NAT Policy Configuration
Mode. In StarOS 8.3, this command is available in the Rulebase Configuration Mode.
Mode. In StarOS 8.3, this command is available in the Rulebase Configuration Mode.
Product
FW
Privilege
Security Administrator, Administrator
Syntax
Sets the default values of TCP intercept parameters for SYN Flood DoS protection.
Default: 5
Specifies the maximum number of attempts for sending proxy SYN to the target. This keyword works in
conjunction with the
Specifies the maximum number of attempts for sending proxy SYN to the target. This keyword works in
conjunction with the
keyword.
specifies the maximum number of attempts for sending proxy SYN to the target after the
timeout duration, and must be an integer from 1 through 5.
Default:
Specifies TCP SYN flood intercept mode:
: Configures TCP SYN flood intercept feature in intercept mode.
: Disables TCP SYN flood intercept feature.
: Configures TCP SYN flood intercept feature in watch mode. The Stateful Firewall passively
watches to see if TCP connections become established within a configurable interval. If connections
are not established within the timeout period, the Stateful Firewall clears the half-open connections
by sending RST to TCP client and server. The default watch-timeout for connection establishment is
30 seconds.
are not established within the timeout period, the Stateful Firewall clears the half-open connections
by sending RST to TCP client and server. The default watch-timeout for connection establishment is
30 seconds.
: Configures TCP SYN flood Intercept or Watch feature for aggressive behavior. Each
new connection request causes the oldest incomplete connection to be deleted. When operating in