« Cisco ASA 5505 Firewall License Restriction for DMZ

DoS Protection for Cisco IP Networks

There are several mechanisms that can be used to protect a Cisco IP network from Denial of Service attacks. Especially for Service Provider networks, DoS Attacks are the biggest threat the network administrators face today. Worms, flooding attacks, Distributed Denial of Service by BotNets etc are some forms of DoS attacks that can hit a Service Provider IP Network. The two most effective security features on Cisco routers to mitigate DoS attacks are the following:

Receive Access Control Lists (rACL)

The Receive ACL feature is applicable on the GSR model routers. It is used to increase security on Cisco 12000 by protecting the router’s gigabit route processor (GRP) from unnecessary and potentially malicious traffic. The rACL feature can be used in combination with Control Plane Policing and Routing Protection to implement a successful defence-in-depth strategy for Control Plane Protection in the Core. This feature is supported in IOS version 12.0(24)S (and newer) of the GSR platform.

The traffic inspected by the rACL is the one passing through the GSR Line Cards (LC) towards the LC CPU (ICMP and Logging) and also traffic passing through the LC towards the route processor (GRP) (Routing Protocols, SSH, Telnet, SNMP, NTP). Because the GRP has limited capacity to handle excessive traffic coming from the Line Cards, there is a danger of a Denial-of-Service attack on the GRP. Receive ACLs explicitly permit or deny traffic destined to the GRP, while transit traffic in the Forwarding (Data) Plane is not affected. Traffic is filtered on the ingress LC prior to RP processing. Deploying rACLs has helped defend against several security advisories in all US Service Providers Network Infrastructure.

Control Plane Policing (CoPP)

The Control Plane Policing mechanism is complementary to the rACL feature. The later controls what protocols and traffic are allowed to flow towards the router processor, while the CoPP feature controls how much traffic is allowed to flow. This feature is applicable on both the GSR 12000 and 7600 routers.
The Control Plane Policing feature treats the CP as a separate entity with its own ingress (input) and egress (output) ports, which are like ports on a router and switch. Because the Control Plane Policing feature treats the CP as a separate entity, a set of rules can be established and associated with the ingress and egress port of the CP. These rules are applied only after the packet has been determined to have the CP as its destination or when a packet exits from the CP. Thereafter, you can configure a service policy to prevent unwanted packets from progressing after a specified rate limit has been reached; for example, a system administrator can limit all TCP/SYN packets that are destined for the CP to a maximum rate of 1 megabit per second.