DHCP and ip verify unicast 1

[StaplesMan]

I am using a 1720 as my home router. I do not have a firewall. Just using ACLs and blocking as much as possible. One of the White Papers on Cisco's site shows how to prevent DDoS attacks.

It recommends the ip verify unicast reverse-path command. I have used it with success. But once my IP renews I don't get it. I have to remove the command then renew MY ip and then re-enable the command.

Is there any modification to the command )like an ACL) that will allow it to work with DHCP.

Thanks,
Bobby

 

[garnetbobcat]

Do you mean that the command disappears from the config when the IP address renews?

Also:

1. ip verify unicast reverse path is probably not doing too much for you other than making the router think more about each packet. It's recommended, but usually for large enterprises or ISPs. According to Cisco, for “Unicast RPF in strict mode, the packet must be received on the interface that the router would use to forward the return packet.”

http://www.cisco.com/web/about/security/intelligence/unicast-rpf.html

Since your ISP is providing you DHCP and you probably only have one link to the Internet, then every packet that arrives is coming from the interface that the router would use to send reply traffic. Thus, uRPF isn't doing much.

Of course, if someone spoofs your inside network and manages to get the packet to the outside of your router then uRPF will drop it, but you could just as easily (and should) block that with an ACL. For example, you should block your inside address space and all RFC 1918 addresses in your outside ACL.

I recently blogged about a good use of uRPF in Remote Triggered Black Holes, if you're interested to see how it is used in larger environments:

http://www.wr-mem.com/?p=42

2. I think the 1720 should be able to run IOS with the Cisco IOS Firewall Feature Set (aka CBAC - Context Based Access Control). IOS Firewall is a stateful firewall and also provides DoS protection, if you're worried about that. It provides DOS protection by clamping half-open TCP sessions and other signs of attack.

Cisco IOS Firewall Docs

http://www.cisco.com/en/US/products/sw/secursw/ps1018/prod_configuration_examples_list.html

Denial of Service Tuning for Cisco IOS Software Firewall and IPS

http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_white_paper0900aecd804e5098.shtml

Cisco IOS Classic Firewall and Intrusion Prevention System Denial-of-Service Protection

http://www.cisco.com/en/US/products...s_configuration_example09186a00808b7200.shtml

Tuning Cisco IOS Firewall Denial-of-Service Protection

http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_white_paper0900aecd8055e6ac.shtml

Matt
CCIE Security

http://www.wr-mem.com

 

[StaplesMan]

I do not get the new IP address from my ISP when ip verify unicast reverse-path is enabled, is basically the problem.

But I now see what you are saying and that it won't be of much help, because I already have private ips blocked as it is.

Once I upgrade the memory and flash I will install the FW IOS and use it. For now I have just the basic.

Thanks,
Bobby

 

[garnetbobcat]

Gotcha. My guess is that ip verify unicast is not compatible with DHCP, then. ;-) Maybe because of the way it relies on the forwarding table or something.

Until you upgrade, you might be interested in reflexive ACLs, or you might just make due with ACLs that are as strict as you can make them.

Reflexive ACLs

http://www.cisco.com/en/US/products...cts_tech_note09186a00800a5b9a.shtml#reflexacl

Matt
CCIE Security

http://www.wr-mem.com

 

[StaplesMan]

Thanks for all this information! I never knew anything about the reflexad ACLs.

Thanks
Bobby

 

[burtsbees]

TCP Intercept is also good to work against DoS attacks, but I now see it is not available for that platform. If you have an 1800 or 2600 series with advanced enterprise, enterprise, or telco image, then you'd be good.

Also, Matt---won't CBAC help him out with DDoS also?

Burt

 

[garnetbobcat]

CBAC will help, but he mentioned in post #3 that he doesn't have the memory to support an image with CBAC.

TCP Intercept is another good suggestion!

Matt
CCIE Security

http://www.wr-mem.com

 

[burtsbees]

Once I upgrade the memory and flash I will install the FW IOS and use it. For now I have just the basic."

Whoopsie...I'm blind!

Thanks!

Burt