Downloads |
 Feedback
|
Table Of Contents
Virtual Fragmentation Reassembly
Restrictions for Virtual Fragmentation Reassembly
Information About Virtual Fragmentation Reassembly
VFR Detection of Fragment Attacks
How to Configure Virtual Fragmentation Reassembly
Enabling VFR Manually on Outbound Interface Traffic
Configuration Examples for Fragmentation Reassembly
Example: Configuring VFR on Outbound Interface Traffic
Feature Information for Virtual Fragmentation Reassembly
Virtual Fragmentation Reassembly
First Published: November 24, 2010Last Updated: November 24, 2010Virtual fragmentation reassembly (VFR) enables the Cisco IOS Firewall to create the appropriate dynamic access control lists (ACLs) to protect the network from various fragmentation attacks.
Without VFR, the Cisco IOS Firewall—specifically Context-based Access Control (CBAC) and the Intrusion Detection System (IDS)—cannot identify the contents of the IP fragments nor can it gather port information from the fragment. These inabilities allow the fragments to pass through the network without being examined or without dynamic ACL creation.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for Virtual Fragmentation Reassembly" section.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•
Restrictions for Virtual Fragmentation Reassembly
•
•
•
•
Restrictions for Virtual Fragmentation Reassembly
Performance Impact
VFR causes a performance impact on the basis of functions such as packet copying, fragment validation, and fragment reorder. This performance impact varies depending on the number of concurrent IP datagrams that are being reassembled.
VFR Configuration Restriction
VFR should not be enabled on a router that is placed on an asymmetric path. The reassembly process requires all of the fragments within an IP datagram. Routers placed in the asymmetric path may not receive all of the fragments, so the fragment reassembly will fail.
Information About Virtual Fragmentation Reassembly
•
VFR Detection of Fragment Attacks
VFR is responsible for detecting and preventing the following types of fragment attacks:
•
VFR drops all tiny fragments, and an alert message such as "VFR-3-TINY_FRAGMENTS" is logged to the syslog server.
•
VFR drops all fragments within a fragment chain if an overlap fragment is detected.
•
To avoid buffer overflow and control memory use, configure a maximum threshold for the number of IP datagrams that are being reassembled and the number of fragments per datagram. You can use the ip virtual-reassembly command or the ip virtual-reassembly-out command to specify these parameters.
When the maximum number of datagrams that can be reassembled at any given time is reached, all subsequent fragments are dropped, and the global statistics item "ReassDrop" is incremented by one.
When the maximum number of fragments per datagram is reached, subsequent fragments are dropped, and the global statistics item "ReassTooManyFrags" is incremented by one. .
In addition to the maximum threshold values being configured, each IP datagram is associated with a managed timer. If the IP datagram does not receive all of the fragments within the specified time, the timer expires and the IP datagram and all of its fragments are dropped.
VFR Enablement
VFR is designed to work with any feature that requires fragment reassembly (such as Cisco IOS Firewall and NAT). By default, NAT enables and disables VFR internally; that is, when NAT is enabled on an interface, VFR is automatically enabled on that interface.
If more than one feature attempts to automatically enable VFR on an interface, VFR will maintain a reference count to keep track of the number of features that have enabled VFR. When the reference count is reduced to zero, VFR is automatically disabled.
VFR on Outbound Interfaces
In Cisco IOS Release XE 3.2S and later releases, you can use the ip virtual-reassembly-out command to manually enable or disable VFR on outbound interface traffic.
How to Configure Virtual Fragmentation Reassembly
•
•
Configuring VFR
Perform this task to enable VFR on an interface, specify maximum threshold values to combat buffer overflow and control memory usage, and verify any VFR configurations.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
DETAILED STEPS
Enabling VFR Manually on Outbound Interface Traffic
Perform this task to enable VFR manually on outbound interface traffic. You can use this procedure to reenable VFR on outbound interface traffic if it is disabled, for example, by the no ip virtual-reassembly command.
Note
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Troubleshooting Tips
To display debugging messages related to the VFR subsystem, use the debug ip virtual-reassembly command.
Configuration Examples for Fragmentation Reassembly
•
Example: Configuring VFR on Outbound Interface Traffic
The following example shows how to manually enable VFR on outbound traffic on interfaces GigabitEthernet0/0/1, GigabitEthernet0/0/0.773, and Serial 3/0:
interface Loopback 0ip address 10.0.1.1 255.255.255.255!interface GigabitEthernet0/0/1description LAN1ip address 10.4.0.2 255.255.255.0ip virtual-reassembly-out!interface GigabitEthernet0/0/0.773encapsulation dot1Q 773description LAN2ip address 10.15.0.2 255.255.255.0ip virtual-reassembly-out!interface Serial 3/0description Internetip unnumbered Loopback0encapsulation pppip virtual-reassembly-outserial restart-delay 0Additional References
Related Documents
Standards
MIBs
None
To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL:
RFCs
Technical Assistance
Feature Information for Virtual Fragmentation Reassembly
Table 1 lists the release history for this feature.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.
© 2010 Cisco Systems, Inc. All rights reserved.
