X670 dos-protection

[Nobel]

Hi, as far as I see X670 have a denial of service protection that can be enabled in the config. We are using some x670's in a ERPS-ring withswitching/VLANS (nothing fancy). Some ports on the x670's are used for aggregation from our access plattform, would we gain any form of DDOS protection from enabeling this on those the uplink-ports?

Do anyone use dos-protection in a similar way?

[Nobel]

Yes we enabled it globally.
I have disabled it now so I do not have any config at the moment.
(15.6.3.1 patch1-5)

[Prashanth_KG]

Hi Nobel,

could you clarify if you had enabled anomaly-protection globally?
the output of "show configuration ipsecurity" could help.

Thanks

[Nobel]

Tested anomaly-protection simply by "enable ip-security anomaly-detection", as a result of that L2TP-tunnels stoped working, have anyone heard of a similar issue?

[dflouret]

Nobel, DoS Protection protects the switch's CPU from attacks. Is that what you are looking for?

I may be wrong but It seems to me that you are trying to prevent the ring from propagating DoS attacks and this feature will not help you in doing that.

There's another security feature in the X670 chipset (also present in many other Summit switches) that is often overlooked: Protocol Anomaly Detection.

From the EXOS User Guide v16.1, pag 957:

Protocol Anomaly Protection
The Extreme chipsets contain built-in hardware protocol checkers that support port security features for security applications, such as stateless DoS protection.

The protocol checkers allow users to drop the packets based on the following conditions, which are checked for ingress packets prior to the L2/L3 entry table:
• SIP = DIP for IPv4/IPv6 packets.
• TCP_SYN Flag = 0 for Ipv4/Ipv6 packets
• TCP Packets with control flags = 0 and sequence number = 0 for Ipv4/Ipv6 packets
• TCP Packets with FIN, URG & PSH bits set & seq. number = 0 for Ipv4/Ipv6 packets
• TCP Packets with SYN & FIN bits are set for Ipv4/Ipv6 packets
• TCP Source Port number = TCP Destination Port number for Ipv4/Ipv6 packets
• First TCP fragment does not have the full TCP header (less than 20 bytes) for Ipv4/Ipv6 packets
• TCP header has fragment offset value as 1 for Ipv4/Ipv6 packets
• UDP Source Port number = UDP Destination Port number for Ipv4/Ipv6 packets
• CMP ping packets payload is larger than programmed value of ICMP max size for Ipv4/Ipv6 packets
• Fragmented ICMP packets for Ipv4/Ipv6 packets

The protocol anomaly detection security functionality is supported by a set of anomaly-protection enable, disable, configure, clear, and show CLI commands. For further details, see the ExtremeXOS Command Reference Guide.

Search for anomaly-protection in the EXOS Command Reference to find the commands needed to enable and configure it.

If you enable this, the chipset will discard any traffic entering the switch that presents any of the protocol anomalies configured. Since many of these anomalies are used in exploits, removing them effectively stops the attack.