Configuring TCP Intercept (Preventing Denial-of-Service Attacks)

The TCP Intercept feature implements software to protect TCP servers from TCP SYN-flooding attacks, which are a type of denial-of-service attacks.

A SYN-flooding attack occurs when a hacker floods a server with a barrage of requests for connection. Because these messages have unreachable return addresses, these connections cannot be established. The resulting volume of unresolved open connections eventually overwhelms the server and causes it to deny service to valid requests, thereby preventing legitimate users from connecting to websites, accessing e-mails, using FTP service, and so on.

The TCP Intercept feature helps prevent SYN-flooding attacks by intercepting and validating TCP connection requests. In intercept mode, the TCP intercept software intercepts TCP synchronization (SYN) packets that match an extended access list from clients to servers. The software establishes a connection with the client on behalf of the destination server, and if successful, establishes a connection with the server on behalf of the client and knits the two half connections transparently. Because of the intercept of SYN packets, connection attempts from unreachable hosts never reach the server. The software continues to intercept and forward packets throughout the duration of the connection. The number of SYN packets per second and the number of concurrent connections that are proxied depends on the platform, memory, processor, and so on.

In case of illegitimate requests, the configured timeouts for half-opened connections and the configured thresholds for TCP connection requests protect destination servers while still allowing valid requests.

When establishing a security policy using TCP intercept, you can choose to intercept either all requests or only those coming from specific networks or destined for specific servers. You can also configure the connection rate and the threshold for outstanding connections.

You can choose to operate TCP intercept in watch mode, as opposed to intercept mode. In watch mode, the software passively watches the connection requests flowing through a router. If a connection fails to get established in a configured interval, the software intervenes and terminates the connection attempt.

• TCP Intercept and Watch Modes
  
• TCP Intercept Timers and Aggressive Thresholds
  

SUMMARY STEPS

1.    enable

2.    configure terminal

3.   access-list access-list-number {deny | permit | remark} {host-ip-address | any | host}

4.   ip tcp intercept list access-list-number

5.   ip tcp intercept mode {intercept | watch}

6.   ip tcp intercept drop-mode {oldest | random}

7.   ip tcp intercept watch-timeout seconds

8.   ip tcp intercept finrst-timeout seconds

9.   ip tcp intercept connection-timeout seconds

10.   ip tcp intercept max-incomplete low number high number

11.   ip tcp intercept one-minute low number high number

12.   exit

13.   show tcp intercept connections

14.   show tcp intercept statistics

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	access-list access-list-number {deny | permit | remark} {host-ip-address | any | host} Example: Router(config)# access-list 20 permit any	Defines an extended IP access list.
Step 4	ip tcp intercept list access-list-number Example: Router(config)# ip tcp intercept list 20	Enables TCP intercept.
Step 5	ip tcp intercept mode {intercept | watch} Example: Router(config)# ip tcp intercept mode intercept	Changes the TCP intercept mode.
Step 6	ip tcp intercept drop-mode {oldest | random} Example: Router(config)# ip tcp intercept drop-mode random	Sets the TCP intercept drop mode.
Step 7	ip tcp intercept watch-timeout seconds Example: Router(config)# ip tcp intercept watch-timeout 200	Defines how long the software waits for a watched TCP intercept connection to reach the established state before sending a reset to the server.
Step 8	ip tcp intercept finrst-timeout seconds Example: Router(config)# ip tcp intercept finrst-timeout 220	Changes the time between receiving a reset or finish (FIN)-exchange and dropping the connection.
Step 9	ip tcp intercept connection-timeout seconds Example: Router(config)# ip tcp intercept connection-timeout 180	Changes the time a TCP connection is managed by TCP intercept after no activity.
Step 10	ip tcp intercept max-incomplete low number high number Example: Router(config)# ip tcp intercept max-incomplete low 3220 high 4550	Sets the threshold for the number of incomplete connections below which the software leaves aggressive mode or the maximum number of incomplete connections allowed before the software enters aggressive mode. In Cisco IOS Release 12.4(15)T, the ip tcp intercept max-incomplete high and ip tcp intercept max-incomplete low commands were replaced by the ip tcp intercept max-incomplete low number high number command.
Step 11	ip tcp intercept one-minute low number high number Example: Router(config)# ip tcp intercept one-minute low 234 high 456	Sets the threshold for the number of connection requests received in the last one-minute below which the software leaves aggressive mode and the number of connection requests that can be received in the last one-minute before the software enters aggressive mode. In Cisco IOS Release 12.4(15)T, the ip tcp intercept one-minute high and ip tcp intercept one-minute low commands were replaced by the ip tcp intercept one-minute low number high number command.
Step 12	exit Example: Router(config)# exit	Exits global configuration mode and enters privileged EXEC mode.
Step 13	show tcp intercept connections Example: Router# show tcp intercept connections	Displays incomplete and established TCP connections.
Step 14	show tcp intercept statistics Example: Router# show tcp intercept statistics	Displays TCP intercept statistics.