PDF(369.5 KB) View with Adobe Reader on a variety of devices
ePub(421.1 KB) View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
Mobi (Kindle)(209.5 KB) View on Kindle device or Kindle app on multiple devices
Updated:August 9, 2017
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Denial of Service (DOS) SYN Filtering Configuration on Sx500 Series Stackable Switches
SYN filtering is one of the DOS prevention features. It is used to prevent TCP connections from a specific port or a LAG. This allows the switch administrator to block unwanted TCP ports. Packets that are destined for these blocked TCP ports will be filtered out of the system. This is mainly used to filter TCP packets that contain the SYN flag.
This article explains how to configure SYN filtering on the Sx500 Series Stackable Switches.
• Sx500 Series Stackable Switches
Step 1. Log in to the web configuration utility and choose Security > Denial of Service Prevention > SYN Filtering. The SYN Filtering page opens:
Step 2. Click Add to add a new SYN filter. The Add SYN filtering window appears.
Step 3. Click the radio button that corresponds to the desired interface type in the Interface field.
• Unit/Slot — From the Unit/Slot drop-down lists choose the appropriate Unit/Slot. The unit identifies whether the switch is active or a member in the stack. The slot identifies which switch is connected to which slot (slot 1 is SF500 and slot 2 is SG500). If you are unfamiliar with the terms used, check out Cisco Business: Glossary of New Terms.
– Port — From the Port drop-down list, choose the appropriate port to configure.
• LAG — Choose on which LAG the STP is advertised from the LAG drop-down list. A Link Aggregate Group (LAG) is used to link multiple ports together. LAGs multiply bandwidth, increase port flexibility, and provide link redundancy between two devices to optimize port usage.
Step 4. Click the radio button that corresponds with the desired IPv4 address in the IPv4 Address field.
• User Defined — Filter is defined to the user defined IP address.
• All addresses — Filter is defined to all IP addresses.
Step 5. Click the radio button that corresponds with the desired network mask in the Network Mask field.
• Mask — Enter the network mask in IP address format. This will define the subnet mask for the IP address.
• Prefix length — Enter the prefix length (integer in the range of 0 to 32). This will define the subnet mask by prefix length for the IP address.
Step 6. Click the radio button that corresponds with the desired TCP port that is to be applied to the filter in the TCP Port field.
• Known ports — From the Known ports drop-down list choose a TCP port to be filtered.