Important: This configuration mode is only available in 8.1, 9.0, and later releases. This configuration mode must be used to configure Policy-based Stateful Firewall and NAT features.
Important: The commands or keywords/variables that are available are dependent on platform type, product version, and installed license(s).access-rule { no-ruledef-matches { downlink | uplink } action { deny [ charging-action charging_action ] | permit [ bypass-nat | nat-realm nat_realm [ fw-and-nat-action name ] ] } | priority priority { [ dynamic-only | static-and-dynamic ] access-ruledef ruledef_name { deny [ charging-action charging_action ] | permit [ [ bypass-nat | nat-realm nat_realm [ fw-and-nat-action name ] ] | trigger open-port { port_number | range start_port to end_port } direction { both | reverse | same } ] } } }
no access-rule priority priority
charging-action charging_action
charging_action must be an alphanumeric string of 1 through 63 characters.
Important: In 9.0 and later releases, this keyword is NAT license dependent.nat-realm nat_realm
Important: In 9.0 and later releases, this keyword is NAT license dependent.nat_realm must be an alphanumeric string of 1 through 31 characters.
priority priority
priority must be an integer from 1 through 65535 that is unique for each access ruledef in the Firewall-and-NAT policy.
[ dynamic-only | static-and-dynamic ] access-ruledef ruledef_name
|
•
|
dynamic-only: Dynamic Ruledef—Predefined ruledef that can be enabled/disabled by the policy server, and is disabled by default.
|
|
•
|
static-and-dynamic: Static and Dynamic Ruledef—Predefined ruledef that can be enabled/disabled by the policy server, and is enabled by default.
|
|
•
|
access-ruledef ruledef_name: Specifies the access ruledef name. ruledef_name must be an alphanumeric string of 1 through 63 characters.
|
trigger open-port { port_number | range start_port to end_port } direction { both | reverse | same }
Important: In 9.0 and later releases, this keyword is Stateful Firewall license dependent.|
•
|
port_number: Specifies the auxiliary port number to open for traffic, and must be an integer from 1 through 65535.
|
|
•
|
|
•
|
start_port must be an integer from 1 through 65535.
|
|
•
|
end_port must be an integer from 1 through 65535, and must be greater than start_port.
|
|
•
|
direction { both | reverse | same }: Specifies the direction from which the auxiliary connection is initiated. This direction can be same as the direction of control connection, or the reverse of the control connection direction, or in both directions.
|
|
•
|
both: Provides the trigger to open port for traffic in either direction of the control connection.
|
|
•
|
reverse: Provides the trigger to open port for traffic in the reverse direction of the control connection (from where the connection is initiated).
|
|
•
|
same: Provides the trigger to open port for traffic in the same direction of the control connection (from where the connection is initiated).
|
Important: For Stateful Firewall, only the terminate-flow action is applicable if configured in the specified charging action.|
•
|
Access ruledef matching is done. If a rule matches, the packet is allowed or dropped as per the access-rule priority configuration.
|
|
•
|
If no access ruledef matches, the packet is allowed or dropped as per the access-rule no-ruledef-matches configuration.
|
For a packet dropped due to access ruledef match or no match (first packet of a flow), the charging action applied is the one configured in the access-rule priority or the access-rule no-ruledef-matches command respectively.
For action on packets dropped due to any error condition after data session is created, the charging action must be configured in the flow any-error charging-action command in the ACS Rulebase Configuration Mode.
For Stateful Firewall, the following command assigns a priority of 10 to the access ruledef test_rule, adds it to the policy, and permits port trigger to be used for the rule to open ports in the range of 1000 to 2000 in either direction of the control connection:
Important: In release 8.0, this configuration is available in the ACS Configuration Mode. In release 8.1, for Rulebase-based Stateful Firewall configuration, this configuration is available in the ACS Rulebase Configuration Mode. In release 8.3, this configuration is available in the ACS Rulebase Configuration Mode.[ no ] firewall dos-protection { all | flooding { icmp | tcp-syn | udp } | ftp-bounce | ip-unaligned-timestamp | ipv6-dst-options [ invalid-options | unknown-options ] | ipv6-extension-hdrs [ limit extension_limit ] | ipv6-frag-hdr nested-fragmentation | ipv6-hop-by-hop [ invalid-options | jumbo-payload | router-alert | unknown-options ] | mime-flood | port-scan | source-router | tcp-window-containment | teardrop | winnuke }
The IPv6 extension headers will be enabled only if the firewall validate-ip-options command is enabled in the Firewall-and-NAT policy configuration.
|
•
|
icmp: Enables protection against ICMP Flood attack.
|
|
•
|
tcp-syn: Enables protection against TCP Syn Flood attack.
|
|
•
|
udp: Enables protection against UDP Flood attack.
|
|
•
|
invalid-options: Drops IPv6 packets containing invalid IPv6 destination options.
|
|
•
|
unknown-options: Drops IPv6 packets containing unknown IPv6 destination options.
|
Firewall will not fully parse packets with unknown extension headers as the extension header format is unspecified. Under such cases, the transport protocol will be considered as unknown. Packets with invalid length field in the extension headers and packets with next header 0x01 (ICMPv4) will be dropped. IPv6 uses ICMPv6 of type 0x3A.
extension_limit must be an integer from 0 through 4294967295.
|
•
|
invalid-options: Drops IPv6 packets containing invalid IPv6 hop-by-hop options.
|
|
•
|
jumbo-payload: Drops IPv6 packets with jumbo payload hop-by-hop options.
|
|
•
|
router-alert: Drops IPv6 packets with router alert hop-by-hop options.
|
|
•
|
unknown-options: Drops IPv6 packets containing unknown IPv6 hop-by-hop options.
|
Important: DoS attacks are detected only in the downlink direction.
Important: In release 8.0, this configuration is available in the ACS Configuration Mode. In release 8.1, for Rulebase-based Stateful Firewall configuration, this configuration is available in the ACS Rulebase Configuration Mode. In release 8.3, this configuration is available in the ACS Rulebase Configuration Mode.firewall flooding { protocol { icmp | tcp-syn | udp } packet limit packets | sampling-interval interval }
|
•
|
icmp: Configuration for ICMP protocol.
|
|
•
|
tcp-syn: Configuration for TCP-SYN packet limit.
|
|
•
|
udp: Configuration for UDP protocol.
|
packet limit packets
packets must be an integer from 1 through 4294967295.
sampling-interval interval
interval must be an integer from 1 through 60.
The following command ensures a subscriber will not receive more than 1000 ICMP packets per sampling interval:
The following command ensures a subscriber will not receive more than 1000 UDP packets per sampling interval on different 5-tuples. That is, if an attacker is sending lot of UDP packets on different ports or using different spoofed IP addresses, those packets will be limited to 1000 packets per sampling interval. This way only “suspected” malicious packets are limited and not “legitimate” packets.
The following command ensures a subscriber will not receive more than 1000 TCP-Syn packets per sampling interval:
Default: drop
The following command configures Stateful Firewall to drop packets with ICMP/ICMPv6 Checksum errors:
Important: In release 8.0, this configuration is available in the ACS Configuration Mode. In release 8.1, for Rulebase-based Stateful Firewall configuration, this configuration is available in the ACS Rulebase Configuration Mode. In release 8.3, this configuration is available in the ACS Rulebase Configuration Mode.Specifies the threshold on the number of ICMP/ICMPv6 error messages sent by the subscriber for a particular data flow. messages must be an integer from 1 through 100.
The following command configures a threshold of 10 ICMP/ICMPv6 error messages:
Default: permit
Default: Enabled. Same as firewall icmp-fsm.
Default: permit
Default: permit
Important: In release 8.0, this configuration is available in the ACS Configuration Mode. In release 8.1, for Rulebase-based Stateful Firewall configuration, this configuration is available in the ACS Rulebase Configuration Mode. In release 8.3, this configuration is available in the ACS Rulebase Configuration Mode.packet_size must be an integer from 30000 through 65535.
|
•
|
icmp: Configuration for ICMP/ICMPv6 protocol.
|
|
•
|
non-icmp: Configuration for protocols other than ICMP/ICMPv6.
|
The following command allows a maximum packet size of 60000 for ICMP/ICMPv6 protocol:
Important: In release 8.0, this configuration is available in the ACS Configuration Mode. In release 8.1, for Rulebase-based Stateful Firewall configuration, this configuration is available in the ACS Rulebase Configuration Mode. In release 8.3, this configuration is available in the ACS Rulebase Configuration Mode.http-headers-limit max_limit
max_limit must be an integer from 1 through 256.
max-http-header-field-size max_size
max_size must be an integer from 1 through 8192.
This command is only effective if Stateful Firewall DoS protection for MIME flood attacks has been enabled using the firewall dos-protection mime-flood command, and the route command has been configured to send HTTP packets to the HTTP analyzer.
Important: In release 8.0, this configuration is available in the ACS Configuration Mode. In release 8.1, for Rulebase-based Stateful Firewall configuration, this configuration is available in the ACS Rulebase Configuration Mode. In release 8.3, this configuration is available in the ACS Rulebase Configuration Mode.
Important: This keyword is available only in 11.0 and earlier releases.Default: drop
Important: In release 9.0, this command is deprecated. This configuration is available as the firewall tcp-fsm [ first-packet-non-syn { drop | permit | send-reset } ] command.Default: drop
Default: drop
|
•
|
drop: Specifies to drop the packet.
|
|
•
|
permit: Specifies to permit the packet.
|
|
•
|
send-reset: Specifies to drop the packet and send TCP RST.
|
Default: drop
Important: In release 9.0 and later this command is also available to NAT.Default: reset
Default: permit
timeout must be an integer from 0 through 86400.
messages must be an integer from 1 through 100.
Important: In release 8.0, this configuration is available in the ACS Configuration Mode. In release 8.1, for Rulebase-based Stateful Firewall configuration, this configuration is available in the ACS Rulebase Configuration Mode. In release 8.3, this configuration is available in the ACS Rulebase Configuration Mode.firewall tcp-syn-flood-intercept { mode { none | watch [ aggressive ] } | watch-timeout intercept_watch_timeout }
|
•
|
none: Disables the TCP SYN Flood Intercept feature.
|
|
•
|
watch: Configures TCP SYN flood intercept feature in watch mode. The Stateful Firewall passively watches to see if TCP connections become established within a configurable interval. If connections are not established within the timeout period, the Stateful Firewall clears the half-open connections by sending RST to TCP client and server. The default watch-timeout for connection establishment is 30 seconds.
|
|
•
|
aggressive: Configures TCP SYN flood Intercept or Watch feature for aggressive behavior. Each new connection request causes the oldest incomplete connection to be deleted. When operating in watch mode, the watch timeout is reduced by half. If the watch-timeout is 30 seconds, under aggressive conditions it becomes 15 seconds. When operating in intercept mode, the retransmit timeout is reduced by half (i.e. if the timeout is 60 seconds, it is reduced to 30 seconds). Thus the amount of time waiting for connections to be established is reduced by half (i.e. it is reduced to 150 seconds from 300 seconds under aggressive conditions).
|
Default: none
watch-timeout intercept_watch_timeout
intercept_watch_timeout must be an integer from 5 through 30.
This command configures Stateful Firewall action on TCP SYN packets with either ECN or CWR flag set.
Default: permit
Default: drop
Default: Disabled. Same as no firewall validate-ip-options
Default: port-chunk-release
edr-format edr_format
edr_format must be an alphanumeric string of 1 through 63 characters.
The following command configures an EDR format named test123 and specifies generating NAT Binding Records when a port chunk is allocated:
Default: Disabled. Same as no nat icsr-flow-recovery.
Important: In release 8.3, this configuration is available in the ACS Rulebase Configuration Mode.nat policy [ ipv4-and-ipv6 | ipv4-only | ipv6-only ] [ default-nat-realm nat_realm_name [ fw-and-nat-action action_name ] ]
Important: This keyword is available only in 12.1 and earlier releases, and is supported in release 12.2 for backward compatibility. The nat policy nat-required command enables only NAT44.default-nat-realm nat_realm_name
nat_realm_name must be the name of an existing NAT realm, and must be an alphanumeric string of 1 through 31 characters.
fw-and-nat-action action_name
action_name must be an alphanumeric string of 1 through 63 characters.
In release 8.1, to enable NAT support for a subscriber, Stateful Firewall must also be enabled for that subscriber. See the firewall policy CLI command.
Once NAT is enabled for a subscriber, the NAT IP address to be used is chosen from the NAT realms specified in the rules. See the access-rule CLI command.
nat private-ip-flow-timeout timeout
timeout must be an integer from 180 through 86400.
This command suppresses sending NAT Bind Update (NBU) to the AAA server when PPP disconnect happens.
Important: This command is customer-specific. For more information please contact your local service representative.