> Firewall-and-NAT Policy Configuration Mode Commands
> The Firewall-and-NAT Policy Configuration Mode enables configuring Firewall-and-NAT policies.
> Important: This configuration mode is only available in 8.1, 9.0, and later releases. This configuration mode must be used to configure Policy-based Stateful Firewall and NAT features.
> Important: The commands or keywords/variables that are available are dependent on platform type, product version, and installed license(s).
> access-rule
> his command creates and configures an access rule.
> Product
> FW, NAT
> Privilege
> Security Administrator, Administrator
> Syntax
> access-rule { no-ruledef-matches { downlink | uplink } action { deny [ charging-action charging_action ] | permit [ bypass-nat | nat-realm nat_realm [ fw-and-nat-action name ] ] } | priority priority { [ dynamic-only | static-and-dynamic ] access-ruledef ruledef_name { deny [ charging-action charging_action ] | permit [ [ bypass-nat | nat-realm nat_realm [ fw-and-nat-action name ] ] | trigger open-port { port_number | range start_port to end_port } direction { both | reverse | same } ] } } }
> default access-rule no-ruledef-matches { downlink | uplink } action
> no access-rule priority priority
> default
> Configures the default setting.
> Default: Uplink direction: permit; Downlink direction: deny
> no
> Removes the access rule specified by the priority.
> no-ruledef-matches
> Configures action on packets with no ruledef match.
> downlink
> Specifies to act on downlink packets with no ruledef match.
> uplink
> Specifies to act on uplink packets with no ruledef match.
> action
> Specifies action to take on downlink/uplink packets with no ruledef match.
> deny
> Specifies to deny packets.
> permit
> Specifies to permit packets and allow the creation of data flows.
> charging-action charging_action
> Specifies the charging action. Optionally, for deny action a charging action can be configured. If a packet matches the deny rule, action is taken as configured in the charging action. If a charging action is specified, the content-ID and billing-action configured in the charging action are used. Also, the flow may be terminated (instead of just discarding the packet), if so configured in the specified charging action.
> charging_action must be an alpha and/or numeric string of 1 through 63 characters in length.
> bypass-nat
> Important: In 9.0 and later releases, this keyword is NAT license dependent.
> Specifies to bypass NAT.
> nat-realm nat_realm
> Important: In 9.0 and later releases, this keyword is NAT license dependent.
> Specifies the NAT realm to be used to perform NAT on subscriber packets matching the access ruledef. If the NAT realm is not specified, NAT will be bypassed. That is, NAT will not be performed on subscriber packets that are matching a ruledef with no NAT realm name configured in it.
> nat_realm must be an alpha and/or numeric string of 1 through 31 characters in length.
> priority priority
> Specifies priority of an access ruledef in the Firewall-and-NAT policy.
> priority must be an integer from 1 through 65535, and must be unique for each access ruledef in the Firewall-and-NAT policy.
> [ dynamic-only | static-and-dynamic ] access-ruledef ruledef_name
> Specifies the access ruledef name. Optionally, the ruledef type can also be specified.

> • | dynamic-only: Dynamic Ruledef—Predefined ruledef that can be enabled/disabled by the policy server, and is disabled by default.

> • | static-and-dynamic: Static and Dynamic Ruledef—Predefined ruledef that can be enabled/disabled by the policy server, and is enabled by default.

> • | access-ruledef ruledef_name: Specifies the access ruledef name. ruledef_name must be an alpha and/or numeric string of 1 through 63 characters in length.

> trigger open-port { port_number | range start_port to end_port } direction { both | reverse | same }
> Important: In 9.0 and later releases, this keyword is Stateful Firewall license dependent.
> Optionally a port trigger can be specified to be used for this rule to limit the range of auxiliary data connections (a single or range of port numbers) for protocols having control and data connections (like FTP). The trigger port will be the destination port of an association which matches a rule.

> • | port_number: Specifies the auxiliary port number to open for traffic, and must be an integer from 1 through 65535.

> • | range start_port to end_port: Specifies the range of port numbers to open for subscriber traffic.

> • | start_port must be an integer from 1 through 65535.

> • | end_port must be an integer from 1 through 65535, and must be greater than start_port.

> • | direction { both | reverse | same }: Specifies the direction from which the auxiliary connection is initiated. This direction can be same as the direction of control connection, or the reverse of the control connection direction, or in both directions.

> • | both: Provides the trigger to open port for traffic in either direction of the control connection.

> • | reverse: Provides the trigger to open port for traffic in the reverse direction of the control connection (from where the connection is initiated).

> • | same: Provides the trigger to open port for traffic in the same direction of the control connection (from where the connection is initiated).

> Usage
> Use this command to add access ruledefs to the Firewall-and-NAT policy and configure the priority and actions for rule matching.
> The policy specifies the rules to be applied on calls. The ruledefs in the policy have priorities, based on which priority matching is done.
> For Stateful Firewall, the port trigger configuration is optional, and can be configured only if a rule action is permit. When a rule is matched and the rule action is permit, if the trigger is configured, the appropriate check is made. The trigger port will be the destination port of an association that matches the rule. Multiple triggers can be defined for the same port number to permit multiple auxiliary ports for subscriber traffic.
> When a rule is matched and if the rule action is deny, the action taken depends on what is configured in the specified charging action. If the flow exists, flow statistics are updated and action is taken as configured in the charging action:

> • | If the billing action is configured as EDR enabled, EDR is generated.

> • | If the content ID is configured, UDR information is updated.

> • | If the flow action is configured as “terminate-flow”, the flow is terminated instead of just discarding the packet.

> If the billing action, content ID, and flow action are not configured, no action is taken on the dropped packets.
> Important: For Stateful Firewall, only the terminate-flow action is applicable if configured in the specified charging action.
> Allowing/dropping of packets is determined in the following sequence:

> • | Check is done to see if the packet matches any pinholes. If yes, no rule matching is done and the packet is allowed.

> • | Access ruledef matching is done. If a rule matches, the packet is allowed or dropped as per the access-rule priority configuration.

> • | If no access ruledef matches, the packet is allowed or dropped as per the access-rule no-ruledef-matches configuration.

> For a packet dropped due to access ruledef match or no match (first packet of a flow), the charging action applied is the one configured in the access-rule priority or the access-rule no-ruledef-matches command respectively.
> For action on packets dropped due to any error condition after data session is created, the charging action must be configured in the flow any-error charging-action command in the ACS Rulebase Configuration Mode.
> The GGSN can dynamically activate/deactivate dynamic ruledefs for a subscriber based on the rule name received from a policy server. At rule match, if a rule in the policy is a dynamic rule, and if the rule is enabled for the particular subscriber, rule matching is done for the rule. If the rule is disabled for the particular subscriber, rule matching is not done for the rule.
> Example
> For Stateful Firewall, the following command assigns a priority of 10 to the access ruledef test_rule, adds it to the policy, and permits port trigger to be used for the rule to open ports in the range of 1000 to 2000 in either direction of the control connection:
> access-rule priority 1 access-ruledef test_rule permit trigger open-port range 1000 to 2000 direction both
> end
> This command returns the CLI prompt to the Exec mode.
> Product
> All
> Privilege
> Security Administrator, Administrator
> Syntax
> end
> Usage
> Use this command to change to the Exec mode.
> exit
> This command exits the current configuration mode and returns to the parent configuration mode.
> Product
> All
> Privilege
> Security Administrator, Administrator
> Syntax
> exit
> Usage
> Use this command to return to the parent configuration mode.
> firewall dos-protection
> This command configures Stateful Firewall protection for subscribers from Denial-of-Service (DoS) attacks.
> Important: In release 8.0, this configuration is available in the ACS Configuration Mode. In release 8.1, for Rulebase-based Stateful Firewall configuration, this configuration is available in the ACS Rulebase Configuration Mode. In release 8.3, this configuration is available in the ACS Rulebase Configuration Mode.
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> [ no ] firewall dos-protection { all | flooding { icmp | tcp-syn | udp } | ftp-bounce | ip-unaligned-timestamp | ipv6-dst-options [ invalid-options | unknown-options ] | ipv6-extension-hdrs [ limit extension_limit ] | ipv6-frag-hdr nested-fragmentation | ipv6-hop-by-hop [ invalid-options | jumbo-payload | router-alert | unknown-options ] | mime-flood | port-scan | source-router | tcp-window-containment | teardrop | winnuke }
> default firewall dos-protection
> no
> Disables Stateful Firewall protection for subscribers against the specified DoS attack(s).
> default
> Disables Stateful Firewall protection for subscribers against all DoS attacks.
> all
> Enables Stateful Firewall protection for subscribers against all DoS attacks supported by the Stateful Firewall service.
> The IPv6 extension headers will be enabled only if the firewall validate-ip-options command is enabled in the Firewall-and-NAT policy configuration.
> flooding { icmp | tcp-syn | udp }
> Enables protection against the specified flooding attack:

> • | icmp: Enables protection against ICMP Flood attack.

> • | tcp-syn: Enables protection against TCP Syn Flood attack.

> • | udp: Enables protection against UDP Flood attack.

> ftp-bounce
> Enables protection against FTP Bounce attacks.
> ip-unaligned-timestamp
> Enables protection against IP Unaligned Timestamp attacks.
> ipv6-dst-options [ invalid-options | unknown-options ]
> Drops IPv6 packets containing IPv6 destination options header.
> The following options are specified in the Destination Options extension header:

> • | The Tunnel Encapsulation Limit (option type: 0x04) is a destination option defined in RFC 2473.

> • | The Home Address option (option type: 0xC9) is part of Mobile IP processing defined in RFC 3775. This option is only valid as a Destination Option.

> • | The NSAP Address option (option type: 0xC3) is assigned as a Destination Option by RFC 1888 and deprecated (reclassified as historic) by RFC 4048.

> • | invalid-options: Drops IPv6 packets containing invalid IPv6 destination options.

> The following values are invalid in a Destination Options extension header option type field. Packets with these options in a Destination Options header will be dropped.

> • | Value 0xC2, Jumbo Payload

> • | Value 0x05, Router Alert

> • | Value 0x06, Quick start

> • | Value 0x07, CALIPSO

> • | unknown-options: Drops IPv6 packets containing unknown IPv6 destination options.

> ipv6-extension-hdrs [ limit extension_limit ]
> Default: 8
> Limits the number of IPv6 extension headers in an IPv6 packet. An IPv6 packet can contain zero or more extension headers.
> Firewall will not fully parse packets with unknown extension headers as the extension header format is unspecified. Under such cases, the transport protocol will be considered as unknown. Packets with invalid length field in the extension headers and packets with next header 0x01 (ICMPv4)will be dropped will be dropped. IPv6 uses ICMPv6 of type 0x3A.
> extension_limit must be an integer from 0 through 4294967295.
> ipv6-frag-hdr nested-fragmentation
> Drops IPv6 packets containing nested fragmentation (reassembled packets containing a fragment header).
> IPv6 fragmentation is done only by source node. An IPv6 fragment packet must have only one fragment header. Firewall will drop packets with more than one fragment header. The Reassembled packet containing a fragment header will be dropped by Firewall. As per RFC 2460, the fragment length (except for last fragment) must be a multiple of 8 octets. If not, such fragments must be dropped.
> ipv6-hop-by-hop [ invalid-options | jumbo-payload | router-alert | unknown-options ]
> Drops IPv6 packets containing hop-by-hop extension header.
> The Hop-by-Hop Options extension header, if present, must be the first header to follow the IPv6 main header. This is indicated by a value of 0x00 in the next header field in the main header. The length must be expressed as a multiple of 8 octets (excluding the first 8 octets). If not, such packets will be dropped.

> • | invalid-options: Drops IPv6 packets containing invalid IPv6 hop-by-hop options.

> The following values are invalid in a Hop-by-Hop extension header option type field. Packets with these options in a hop-by-hop header will be dropped.

> • | Value 0x04, Tunnel Encapsulation limit

> • | Value 0xC9, Home Address Destination option

> • | Value 0xC3, NSAP Address option

> The options are present in TLV (Type Length Value) format. If the length specified is invalid, then such packets will be dropped.

> • | jumbo-payload: Drops IPv6 packets with jumbo payload hop-by-hop options.

> The Jumbo Payload option (RFC 2675) has the option type value 0xC2 and is only valid as a Hop-by-Hop option. This option allows the creation of very large IP packets (packets larger than 65K bytes). If this option is allowed, the following validity checks will be done.

> • | The IP payload length must be 0x00 when the Jumbo Payload option is present.

> • | The Jumbo Payload option must be used only when the length is greater than 65,535 (i.e. the two most significant bytes of the Jumbo length cannot be 0x00).

> • | The Jumbo Payload option cannot be used in conjunction with a Fragmentation extension header.

> If any of the above checks fail, then the IPv6 packet will be dropped. The Option Type field must have 4n+2 alignment.

> • | router-alert: Drops IPv6 packets with router alert hop-by-hop options.

> The Router Alert (RFC 2711) option is used to signal the routers that a closer inspection of the packet is warranted. Denial of service (DOS) attacks can occur if an attacker sends large number of packets with this option. Only one option of this type must be present, regardless of value, per Hop-by-Hop header with 2n + 0 alignment.

> • | unknown-options: Drops IPv6 packets containing unknown IPv6 hop-by-hop options.

> mime-flood
> Enables protection against HTTP Multiple Internet Mail Extension (MIME) header flooding attacks.
> port-scan
> Enables protection against Port Scan attacks.
> tcp-window-containment
> Enables protection against TCP sequence number out-of-range attacks.
> source-router
> Enables protection against IPv4/IPv6 Source Route IP Option attacks.
> This command can be used to filter IPv4/IPv6 packets containing Routing header of Type 0 (source routing). In this release, only type 0 filtering is supported.
> teardrop
> Enables protection against IPv4/IPv6 Teardrop attacks.
> winnuke
> Enables protection against WIN-NUKE attacks.
> Usage
> Use this command to enable Stateful Firewall protection from different types of DoS attacks. This command can be used multiple times for different DoS attacks.
> Important: DoS attacks are detected only in the downlink direction.
> Example
> The following command enables protection from all supported DoS attacks:
> firewall dos-protection all
> firewall flooding
> This command configures Stateful Firewall protection from Packet Flooding attacks.
> Important: In release 8.0, this configuration is available in the ACS Configuration Mode. In release 8.1, for Rulebase-based Stateful Firewall configuration, this configuration is available in the ACS Rulebase Configuration Mode. In release 8.3, this configuration is available in the ACS Rulebase Configuration Mode.
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> firewall flooding { protocol { icmp | tcp-syn | udp } packet limit packets | sampling-interval interval }
> default firewall flooding { protocol { icmp | tcp-syn | udp } packet limit | sampling-interval }
> default
> Configures the default setting for the specified configuration.
> protocol { icmp | tcp-syn | udp }
> Specifies the transport protocol:

> • | icmp: Configuration for ICMP protocol.

> • | tcp-syn: Configuration for TCP-SYN packet limit.

> • | udp: Configuration for UDP protocol.

> packet limit packets
> Specifies the maximum number of specified packets a subscriber can receive during a sampling interval.
> packets must be an integer from 1 through 4294967295.
> Default: 1000 packets per sampling interval for all protocols.
> sampling-interval interval
> Specifies the flooding sampling interval, in seconds.
> interval must be an integer from 1 through 60.
> Default: 1 second
> The maximum sampling-interval configurable is 60 seconds.
> Usage
> Use this command to configure the maximum number of ICMP, TCP-SYN, / UDP packets allowed to prevent the packet flooding attacks to the host.
> Example
> The following command ensures a subscriber will not receive more than 1000 ICMP packets per sampling interval:
> firewall flooding protocol icmp packet limit 1000
> The following command ensures a subscriber will not receive more than 1000 UDP packets per sampling interval on different 5-tuples. That is, if an attacker is sending lot of UDP packets on different ports or using different spoofed IPs, those packets will be limited to 1000 packets per sampling interval. This way only “suspected” malicious packets are limited and not “legitimate” packets.
> firewall flooding protocol udp packet limit 1000
> The following command ensures a subscriber will not receive more than 1000 TCP-Syn packets per sampling interval:
> firewall flooding protocol tcp-syn packet limit 1000
> The following command specifies a flooding sampling interval of 1 second:
> firewall flooding sampling-interval 1
> firewall icmp-checksum-error
> This command configures Stateful Firewall action on packets with ICMP/ICMPv6 Checksum errors.
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> firewall icmp-checksum-error { drop | permit }
> default firewall icmp-checksum-error
> default
> Configures the default setting.
> Default: drop
> drop
> Specifies to drop packets with ICMP/ICMPv6 Checksum errors.
> permit
> Specifies to permit packets with ICMP/ICMPv6 Checksum errors.
> Usage
> Use this command to configure Stateful Firewall action on packets with ICMP/ICMPv6 Checksum errors. This CLI also applies to ICMP/ICMPv6 packets with Inner IP Checksum error.
> For NAT-only calls, packets with ICMP/ICMPv6 errors are dropped, and other packets are allowed.
> Example
> The following command configures Stateful Firewall to drop packets with ICMP/ICMPv6 Checksum errors:
> firewall icmp-checksum-error drop
> firewall icmp-destination-unreachable-message-threshold
> This command configures a threshold on the number of ICMP/ICMPv6 error messages sent by the subscriber for a particular data flow.
> Important: In release 8.0, this configuration is available in the ACS Configuration Mode. In release 8.1, for Rulebase-based Stateful Firewall configuration, this configuration is available in the ACS Rulebase Configuration Mode. In release 8.3, this configuration is available in the ACS Rulebase Configuration Mode.
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> firewall icmp-destination-unreachable-message-threshold messages then-block-server
> { default | no } firewall icmp-destination-unreachable-message-threshold
> default
> Configures the default setting.
> Default: No limit
> no
> Removes the previous configuration.
> messages
> Specifies the threshold on the number of ICMP/ICMPv6 error messages sent by the subscriber for a particular data flow. messages must be an integer from 1 through 100.
> Usage
> Use this command to configure a threshold on the number of ICMP/ICMPv6 error messages sent by the subscriber for a particular data flow. After the threshold is reached, it is assumed that the server is not reacting properly to the error messages, and further downlink traffic to the subscriber on the unwanted flow is blocked.
> Some servers that run QChat ignore the ICMP/ICMPv6 error messages (Destination Port Unreachable and Host Unreachable) from the mobiles. So the mobiles continue to receive unwanted UDP traffic from the QChat servers, and their batteries get exhausted quickly.
> Example
> The following command configures a threshold of 10 ICMP/ICMPv6 error messages:
> firewall icmp-destination-unreachable-message-threshold 10 then-block-server
> firewall icmp-echo-id-zero
> This command configures Stateful Firewall action on echo packets with ICMP/ICMPv6 ID zero.
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> firewall icmp-echo-id-zero { drop | permit }
> default firewall icmp-echo-id-zero
> default
> Configures the default setting.
> Default: permit
> drop
> Specifies to drop packets with ICMP/ICMPv6 ID zero.
> permit
> Specifies to permit packets with ICMP/ICMPv6 ID zero.
> Usage
> Use this command to configure Stateful Firewall action on echo packets with ICMP/ICMPv6 ID zero.
> Example
> The following command configures Stateful Firewall to drop packets with ICMP/ICMPv6 ID zero:
> firewall icmp-echo-id-zero drop
> firewall icmp-fsm
> This command enables/disables Stateful Firewall’s ICMP/ICMPv6 Finite State Machine (FSM).
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> [ default | no ] firewall icmp-fsm
> default
> Configures the default setting.
> Default: Enabled. Same as firewall icmp-fsm.
> no
> Disables Stateful Firewall ICMP/ICMPv6 FSM checks.
> Usage
> Use this command to enable/disable Stateful Firewall ICMP/ICMPv6 FSM checks. When Stateful Firewall and ICMP/ICMPv6 FSM are enabled, ICMP/ICMPv6 reply messages for which there is no saved ICMP/ICMPv6 request message are discarded. ICMP/ICMPv6 error messages (i.e., messages containing an embedded message) for which there is no saved flow for the embedded message are discarded.
> Example
> The following command disables Stateful Firewall’s ICMP/ICMPv6 FSM checks:
> no firewall icmp-fsm
> firewall ip-reassembly-failure
> This command configures Stateful Firewall action on IPv4/IPv6 packets involved in IP Reassembly Failure scenarios.
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> firewall ip-reassembly-failure { drop | permit }
> default firewall ip-reassembly-failure
> default
> Configures the default setting.
> Default: permit
> drop
> Specifies to drop IPv4/IPv6 packets involved in IP reassembly failure scenarios.
> permit
> Specifies to permit IPv4/IPv6 packets involved in IP reassembly failure scenarios.
> Usage
> Use this command to configure Stateful Firewall action on IPv4/IPv6 packets involved in IP reassembly failure scenarios such as missing fragments, overlapping offset, etc.
> For NAT-only calls, packets involved in IP reassembly failure scenarios are dropped.
> Example
> The following command specifies to drop IPv4/IPv6 packets involved in IP reassembly failure scenarios:
> firewall ip-reassembly-failure drop
> firewall malformed-packets
> This command configures Stateful Firewall action on malformed packets. In release 12.0, this command is enhanced to support ICMPv6 and IPv6 packets.
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> firewall malformed-packets { drop | permit }
> default firewall malformed-packets
> default
> Configures the default setting.
> Default: permit
> drop
> Specifies to drop malformed packets.
> permit
> Specifies to permit malformed packets.
> Usage
> Use this command to configure Stateful Firewall action on malformed packets.
> For NAT-only calls, malformed packets are always permitted.
> Example
> The following command specifies Stateful Firewall to drop malformed packets:
> firewall malformed-packets drop
> firewall max-ip-packet-size
> This command configures the maximum IPv4/IPv6 packet size (after IP reassembly) allowed over Stateful Firewall.
> Important: In release 8.0, this configuration is available in the ACS Configuration Mode. In release 8.1, for Rulebase-based Stateful Firewall configuration, this configuration is available in the ACS Rulebase Configuration Mode. In release 8.3, this configuration is available in the ACS Rulebase Configuration Mode.
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> firewall max-ip-packet-size packet_size protocol { icmp | non-icmp }
> default firewall max-ip-packet-size protocol { icmp | non-icmp }
> default
> Configures the default setting.
> Default: 65535 bytes (for both ICMP/ICMPv6 and non-ICMP/ICMPv6)
> packet_size
> Specifies the maximum packet size allowed by firewall. Any IPv6 packet with payload size greater than the configured value will be dropped.
> packet_size must be an integer from 30000 through 65535.
> protocol { icmp | non-icmp }
> Specifies the transport protocol:

> • | icmp: Configuration for ICMP/ICMPv6 protocol.

> • | non-icmp: Configuration for protocols other than ICMP/ICMPv6.

> Usage
> Use this command to configure the maximum IPv4/IPv6 packet size allowed for ICMP/ICMPv6 and non-ICMP/ICMPv6 packets to prevent packet flooding attacks to the host. Packets exceeding the configured size will be dropped for “Jolt” and “Ping-Of-Death” attacks.
> Example
> The following command allows a maximum packet size of 60000 for ICMP/ICMPv6 protocol:
> firewall max-ip-packet-size 60000 protocol icmp
> firewall mime-flood
> This command configures Stateful Firewall protection from MIME Flood attacks.
> Important: In release 8.0, this configuration is available in the ACS Configuration Mode. In release 8.1, for Rulebase-based Stateful Firewall configuration, this configuration is available in the ACS Rulebase Configuration Mode. In release 8.3, this configuration is available in the ACS Rulebase Configuration Mode.
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> firewall mime-flood { http-headers-limit max_limit | max-http-header-field-size max_size }
> default firewall mime-flood { http-headers-limit | max-http-header-field-size }
> default
> Configures the default setting for the specified parameter.
> http-headers-limit max_limit
> Specifies the maximum number of headers allowed in an HTTP packet. If the number of HTTP headers in a page received is more than the specified limit, the request will be denied.
> max_limit must be an integer from 1 through 256.
> Default: 16
> max-http-header-field-size max_size
> Specifies the maximum header field size allowed in the HTTP header, in bytes. If the size of HTTP header in the received page is more than the specified number of bytes, the request will be denied.
> max_size must be an integer from 1 through 8192.
> Default: 4096 bytes
> Usage
> Use this command to configure the maximum number of headers allowed in an HTTP packet, and the maximum header field size allowed in the HTTP header to prevent MIME flooding attacks.
> This command is only effective if Stateful Firewall DoS protection for MIME flood attacks has been enabled using the firewall dos-protection mime-flood command, and the route command has been configured to send HTTP packets to the HTTP analyzer.
> Example
> The following command sets the maximum number of headers allowed in an HTTP packet to 100:
> firewall mime-flood http-headers-limit 100
> The following command sets the maximum header field size allowed in the HTTP header to 1000 bytes:
> firewall mime-flood max-http-header-field-size 1000
> firewall policy
> This command enables/disables Stateful Firewall support in a Firewall-and-NAT policy.
> Important: In release 8.0, this configuration is available in the ACS Configuration Mode. In release 8.1, for Rulebase-based Stateful Firewall configuration, this configuration is available in the ACS Rulebase Configuration Mode. In release 8.3, this configuration is available in the ACS Rulebase Configuration Mode.
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> In 11.0 and earlier releases:
> firewall policy firewall-required
> no firewall policy
> In 12.0 and later releases:
> firewall policy { ipv4-and-ipv6 | ipv4-only | ipv6-only }
> { default | no } firewall policy
> default
> Disables IPv4 and IPv6 Stateful Firewall support in the Firewall-and-NAT policy.
> no
> Disables IPv4 and IPv6 Stateful Firewall support in the Firewall-and-NAT policy.
> firewall-required
> Enables Stateful Firewall support in the Firewall-and-NAT policy.
> Important: This keyword is available only in 11.0 and earlier releases.
> ipv4-and-ipv6
> Enables both IPv4 and IPv6 Stateful Firewall support in the Firewall-and-NAT policy.
> ipv4-only
> Enables IPv4 Stateful Firewall and disables IPv6 Stateful Firewall in the Firewall-and-NAT policy.
> ipv6-only
> Enables IPv6 Stateful Firewall and disables IPv4 Stateful Firewall support in the Firewall-and-NAT policy.
> Usage
> Use this command to enable/disable IPv4 and/or IPv6 Stateful Firewall support for all subscribers using a Firewall-and-NAT policy.
> Example
> The following command enables IPv4 and IPv6 Stateful Firewall support in a Firewall-and-NAT policy:
> firewall policy ipv4-and-ipv6
> The following command disables Stateful Firewall support in a Firewall-and-NAT policy:
> no firewall policy
> firewall tcp-checksum-error
> This command configures Stateful Firewall action on packets with TCP Checksum error.
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> firewall tcp-checksum-error { drop | permit }
> default firewall tcp-checksum-error
> default
> Configures the default setting.
> Default: drop
> drop
> Specifies to drop packets with TCP Checksum errors.
> permit
> Specifies to permit packets with TCP Checksum errors.
> Usage
> Use this command to configure Stateful Firewall action on packets with TCP Checksum error.
> For NAT-only calls, packets with TCP Checksum errors are permitted.
> Example
> The following command specifies Stateful Firewall to drop packets with TCP Checksum errors:
> firewall tcp-checksum-error drop
> firewall tcp-first-packet-non-syn
> This command configures Stateful Firewall action on TCP flows starting with a non-SYN packet.
> Important: In release 9.0, this command is deprecated. This configuration is available as the firewall tcp-fsm [ first-packet-non-syn { drop | permit | send-reset } ] command.
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> firewall tcp-first-packet-non-syn { drop | reset }
> default firewall tcp-first-packet-non-syn
> default
> Configures the default setting.
> Default: drop
> drop
> Specifies to drop the non-SYN packet.
> reset
> Specifies to send reset.
> Usage
> Use this command to configure Stateful Firewall action on TCP flows starting with a non-SYN packet.
> Example
> For flows starting with a non-SYN packet, the following command specifies Stateful Firewall to drop the non-SYN packet:
> firewall tcp-first-packet-non-syn drop
> firewall tcp-fsm
> This command enables/disables Stateful Firewall’s TCP Finite State Machine (FSM).
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> firewall tcp-fsm [ first-packet-non-syn { drop | permit | send-reset } ]
> { default | no } firewall tcp-fsm
> default
> Configures the default setting.
> Default: drop
> no
> Disables Stateful Firewall’s TCP FSM.
> first-packet-non-syn { drop | permit | send-reset }
> Specifies Stateful Firewall action on TCP flows starting with a non-SYN packet:

> • | drop: Specifies to drop the packet.

> • | permit: Specifies to permit the packet.

> • | send-reset: Specifies to drop the packet and send TCP RST.

> Default: drop
> Usage
> Use this command to enable/disable Stateful Firewall’s TCP FSM checks. When Stateful Firewall and TCP FSM are enabled, state of the TCP session is checked to decide whether to forward TCP packets.
> Example
> The following command enables TCP FSM, and configures action to take on TCP flows starting with a non-SYN packet to drop the packet:
> firewall tcp-fsm first-packet-non-syn drop
> firewall tcp-idle-timeout-action
> This command configures action on TCP idle timeout expiry.
> Important: In release 9.0 and later this command is also available to NAT.
> Product
> FW, NAT
> Privilege
> Security Administrator, Administrator
> Syntax
> firewall tcp-idle-timeout-action { drop | reset }
> { default | no } firewall tcp-idle-timeout-action
> default
> Configures the default setting.
> Default: reset
> no
> Configures the TCP idle timeout expiry action to reset.
> drop
> Specifies to drop the session on TCP idle timeout expiry.
> reset
> Specifies to resend TCP RST on TCP idle timeout expiry. When configured to reset, the session is dropped, and the system can avoid packets arriving for the idle flow from getting dropped.
> Usage
> Use this command to configure action to take on TCP idle timeout expiry.
> Example
> The following command configures action to take on TCP idle timeout expiry to drop:
> firewall tcp-idle-timeout-action drop
> firewall tcp-options-error
> This command configures Stateful Firewall action on packets with TCP Option errors.
> Product
> FW
> Privileges
> Security Administrator, Administrator
> Syntax
> firewall tcp-options-error { drop | permit }
> default firewall tcp-options-error
> default
> Configures the default setting.
> Default: permit
> drop
> Specifies to drop packets with TCP Option errors.
> permit
> Specifies to permit packets with TCP Option errors.
> Usage
> Use this command to configure Stateful Firewall action on packets with TCP Option errors.
> Example
> The following command configures Stateful Firewall to drop packets with TCP Option errors:
> firewall tcp-options-error drop
> firewall tcp-partial-connection-timeout
> This command configures action on idle timeout for partially open TCP connections.
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> firewall tcp-partial-connection-timeout timeout
> { default | no } firewall tcp-partial-connection-timeout
> default
> Configures the default setting.
> no
> Disables the idle timeout for partially open TCP connections.
> timeout
> Specifies the timeout in seconds.
> timeout must be an integer from 0 to 86400.
> Default: 30 seconds
> Usage
> Use this command to configure idle timeout for TCP connections that are yet to be established (partially open) in the case of Firewall enabled calls.
> Example
> The following command sets the idle timeout setting to 30 seconds:
> firewall tcp-partial-connection-timeout 30
> firewall tcp-reset-message-threshold
> This command configures a threshold on the number of TCP reset messages sent by the subscriber for a particular data flow. After this threshold is reached, further downlink traffic to the subscriber on the unwanted flow is blocked.
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> firewall tcp-reset-message-threshold messages then-block-server
> { default | no } firewall tcp-reset-message-threshold
> default
> Configures the default setting.
> Default: Disabled
> no
> Disables the configuration.
> messages
> Specifies the threshold on the number of TCP reset messages sent by the subscriber for a particular data flow.
> messages must be an integer from 1 through 100.
> Usage
> Use this command to configure a threshold on the number of TCP reset messages (TCP RST+ACK) sent by the subscriber for a particular data flow. After the threshold is reached, assuming the server is not reacting properly to the reset messages further downlink traffic to the subscriber on the unwanted flow is blocked. This configuration enables QCHAT noise suppression for TCP.
> Example
> The following command sets the threshold on the number of TCP reset messages to 10:
> firewall tcp-reset-message-threshold 10 then-block-server
> firewall tcp-syn-flood-intercept
> This command configures TCP SYN intercept parameters for protection against TCP SYN flooding attacks.
> Important: In release 8.0, this configuration is available in the ACS Configuration Mode. In release 8.1, for Rulebase-based Stateful Firewall configuration, this configuration is available in the ACS Rulebase Configuration Mode. In release 8.3, this configuration is available in the ACS Rulebase Configuration Mode.
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> firewall tcp-syn-flood-intercept { mode { none | watch [ aggressive ] } | watch-timeout intercept_watch_timeout }
> default firewall tcp-syn-flood-intercept { mode | watch-timeout }
> default
> Configures the default settings for SYN Flood DoS protection.
> mode { none | watch [ aggressive ] }
> Specifies the TCP SYN flood intercept mode:

> • | none: Disables the TCP SYN Flood Intercept feature.

> • | watch: Configures TCP SYN flood intercept feature in watch mode. The Stateful Firewall passively watches to see if TCP connections become established within a configurable interval. If connections are not established within the timeout period, the Stateful Firewall clears the half-open connections by sending RST to TCP client and server. The default watch-timeout for connection establishment is 30 seconds.

> • | aggressive: Configures TCP SYN flood Intercept or Watch feature for aggressive behavior. Each new connection request causes the oldest incomplete connection to be deleted. When operating in watch mode, the watch timeout is reduced by half. If the watch-timeout is 30 seconds, under aggressive conditions it becomes 15 seconds. When operating in intercept mode, the retransmit timeout is reduced by half (i.e. if the timeout is 60 seconds, it is reduced to 30 seconds). Thus the amount of time waiting for connections to be established is reduced by half (i.e. it is reduced to 150 seconds from 300 seconds under aggressive conditions).

> Default: none
> watch-timeout intercept_watch_timeout
> Specifies the TCP intercept watch timeout, in seconds.
> intercept_watch_timeout must be an integer from 5 through 30.
> Default: 30
> Usage
> This TCP intercept functionality provides protection against TCP SYN Flooding attacks. This command enables and configures TCP intercept parameters to prevent TCP SYN flooding attacks by intercepting and validating TCP connection requests for DoS protection mechanism configured with the dos-protection command.
> The system captures TCP SYN requests and responds with TCP SYN-ACKs. If a connection initiator completes the handshake with a TCP ACK, the TCP connection request is considered as valid by system and system forwards the initial TCP SYN to the valid target which triggers the target to send a TCP SYN-ACK. Now system intercepts with TCP SYN-ACK and sends the TCP ACK to complete the TCP handshake. Any TCP packet received before the handshake completion will be discarded.
> Example
> The following command sets the intercept watch timeout setting to 15 seconds:
> firewall tcp-syn-flood-intercept watch-timeout 15
> firewall tcp-syn-with-ecn-cwr
> This command configures Stateful Firewall action on TCP SYN packets with either ECN or CWR flag set.
> Product
> FW
> Privileges
> Security Administrator, Administrator
> Syntax
> firewall tcp-syn-with-ecn-cwr { drop | permit }
> default firewall tcp-syn-with-ecn-cwr
> default
> Configures the default setting.
> Default: permit
> drop
> Specifies to drop TCP SYN packets with either ECN or CWR flag set.
> permit
> Specifies to permit TCP SYN packets with either ECN or CWR flag set.
> Usage
> Use this command to configure Stateful Firewall action on receiving a TCP SYN packet with either ECN or CWR flag set.
> Example
> The following command configures Stateful Firewall to drop TCP SYN packets with ECN / CWR flag set:
> firewall tcp-syn-with-ecn-cwr drop
> firewall udp-checksum-error
> This command configures Stateful Firewall action on packets with UDP Checksum error.
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> firewall udp-checksum-error { drop | permit }
> default firewall udp-checksum-error
> default
> Configures the default setting.
> Default: drop
> drop
> Specifies to drop packets with UDP Checksum error.
> permit
> Specifies to permit packets with UDP Checksum error.
> Usage
> Use this command to configure Stateful Firewall action on packets with UDP Checksum error.
> For NAT-only calls, packets with UDP Checksum error are permitted.
> Example
> The following command specifies to drop packets with UDP Checksum error:
> firewall udp-checksum-error drop
> firewall validate-ip-options
> This command enables / disables the Stateful Firewall validation of IP options for errors.
> Product
> FW
> Privilege
> Security Administrator, Administrator
> Syntax
> [ default | no ] firewall validate-ip-options
> default
> Configures the default setting.
> Default: Disabled. Same as no firewall validate-ip-options
> no
> Disables validation of IP options.
> Usage
> Use this command to enable / disable Stateful Firewall validation of IP options. When enabled, Stateful Firewall will drop packets with IP option errors.
> For NAT calls, validation of IP Options is disabled.
> Example
> The following command enables validation of IP options:
> firewall validate-ip-options
> nat binding-record
> This command configures the generation of NAT Binding Records.
> Product
> NAT
> Privilege
> Security Administrator, Administrator
> Syntax
> nat binding-record edr-format edr_format [ port-chunk-allocation ] [ port-chunk-release ]
> { default | no } nat binding-record
> default
> Configures the default setting.
> Default: port-chunk-release
> no
> Disables generating NAT Binding Records.
> edr-format edr_format
> Specifies the EDR format name.
> edr_format must be an alpha and/or numeric string of 1 through 63 characters in length.
> port-chunk-allocation
> Specifies generating NAT Binding Records when a port-chunk is allocated.
> port-chunk-release
> Specifies generating NAT Binding Record when a port-chunk is released.
> Usage
> Use this command to configure the generation of NAT Binding Records.
> Example
> The following command configures an EDR format named test123 and specifies generating NAT Binding Records when a port chunk is allocated:
> nat binding-record edr-format test123 port-chunk-allocation
> nat policy
> This command enables/disables Network Address Translation (NAT) support in a Firewall-and-NAT policy.
> Important: In release 8.3, this configuration is available in the ACS Rulebase Configuration Mode.
> Product
> NAT
> Privilege
> Security Administrator, Administrator
> Syntax
> nat policy nat-required [ default-nat-realm nat_realm_name [ fw-and-nat-action action_name ] ]
> no nat policy
> no
> Disables both NAT support in the Firewall-and-NAT policy.
> nat-required
> Enables NAT support in the Firewall-and-NAT policy.
> default-nat-realm nat_realm_name
> Specifies the default NAT realm for the Firewall-and-NAT policy.
> nat_realm_name must be the name of an existing NAT realm, and must be an alpha and/or numeric string of 1 through 31 characters in length.
> fw-and-nat-action action_name
> Specifies the Firewall-and-NAT action name.
> action_name must be an alpha and/or numeric string of 1 through 63 characters in length.
> Usage
> Use this command to enable/disable NAT support for all subscribers using a Firewall-and-NAT policy.
> In release 8.1, to enable NAT support for a subscriber, State ful Firewall must also be enabled for that subscriber. See the firewall policy CLI command.
> Once NAT is enabled for a subscriber, the NAT IP address to be used is chosen from the NAT realms specified in the rules. See the access-rule CLI command.
> You can enable/disable NAT at any time, however the changed NAT status will not be applied to active calls. The new NAT status will only be applied to new calls.
> Example
> The following command enables NAT support in a Firewall-and-NAT policy:
> nat policy nat-required
> The following command disables NAT support in a Firewall-and-NAT policy:
> no nat policy
> nat private-ip-flow-timeout
> This command configures the Private IP NPU flow timeout setting.
> Product
> NAT
> Privilege
> Security Administrator, Administrator
> Syntax
> nat private-ip-flow-timeout timeout
> { default | no } nat private-ip-flow-timeout
> default
> Configures the default setting.
> Default: 180 seconds
> no
> Disables the Private IP NPU flow timeout configuration.
> When disabled, the flow is installed at call setup and will be removed only when the subscriber disconnects.
> timeout
> Specifies the Private IP NPU flow timeout period in seconds.
> timeout must be an integer from 180 through 86400.
> Usage
> Use this command to configure the Private IP NPU flow timeout setting.
> For NAT-enabled calls, by default, the downlink private IP NPU flow will not be installed at call setup for a subscriber session. The flow will only be installed on demand. When there is no traffic on the private flow, the private IP flow will be removed after the configurable timeout period.
> Example
> The following command configures the Private IP NPU flow timeout setting to 36000 seconds:
> nat private-ip-flow-timeout 36000
> nat suppress-aaa-update
> This command suppresses sending NAT Bind Update (NBU) to the AAA server when PPP disconnect happens.
> Important: This command is customer-specific. For more information please contact your local service representative.
> Product
> NAT
> Privilege
> Security Administrator, Administrator
> Syntax
> nat suppress-aaa-update call-termination
> default nat suppress-aaa-update
> default
> Configures the default setting.
> Default: No suppression of AAA updates.
> Usage
> Use this command to suppress sending of NBU to the AAA server when PPP disconnect happens, as these NBUs would be cleared at the AAA after receiving the accounting-stop. This enables to minimize the number of messages between the chassis and AAA server. When not configured, NBU are sent to the AAA server whenever a port chunk is allocated, de-allocated, or the call is cleared (PPP disconnect).
> Example
> The following command suppresses the sending of NBU to the AAA server:
> nat suppress-aaa-update call-termination

Cisco Systems Inc.
Tel: 408-526-4000
Fax: 408-527-0883