Summary of the content on the page No. 1
53-1002440-03
®
June 2012
ServerIron ADX
Security Guide
Supporting Brocade ServerIron ADX version 12.4.00a
Summary of the content on the page No. 2
© 2012 Brocade Communications Systems, Inc. All Rights Reserved. Brocade, Brocade Assurance, the B-wing symbol, DCX, Fabric OS, MLX, SAN Health, VCS, and VDX are registered trademarks, and AnyIO, Brocade One, CloudPlex, Effortless Networking, ICX, NET Health, OpenScript, and The Effortless Network are trademarks of Brocade Communications Systems, Inc., in the United States and/or in other countries. Other brands, products, or service names mentioned may be trademarks of their respective owne
Summary of the content on the page No. 3
Contents About This Document Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Supported hardware and software . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Document conventions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Text formatting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Notes, cautions, and danger notices . . . . . . . . . . . . . . . . . . . . .
Summary of the content on the page No. 4
Transaction Rate Limit (TRL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Understanding transaction rate limit . . . . . . . . . . . . . . . . . . . . . . 7 Configuring transaction rate limit . . . . . . . . . . . . . . . . . . . . . . . . . 8 Configuring the maximum number of rules . . . . . . . . . . . . . . . .12 Saving a TRL configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13 Transaction rate limit command reference . . . . . . . . . . . . . . . .13
Summary of the content on the page No. 5
Firewall load balancing enhancements. . . . . . . . . . . . . . . . . . . . . . .34 Enabling firewall strict forwarding. . . . . . . . . . . . . . . . . . . . . . . .34 Enabling firewall VRRPE priority . . . . . . . . . . . . . . . . . . . . . . . . .34 Enabling track firewall group. . . . . . . . . . . . . . . . . . . . . . . . . . . .35 Enabling firewall session sync delay. . . . . . . . . . . . . . . . . . . . . .35 Syn-cookie threshhold trap. . . . . . . . . . . . . . . . . . . . . . . . . .
Summary of the content on the page No. 6
ACL logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .70 Displaying ACL log entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Displaying ACL statistics for flow-based ACLs . . . . . . . . . . . . . .72 Clearing flow-based ACL statistics . . . . . . . . . . . . . . . . . . . . . . .72 Dropping all fragments that exactly match a flow-based ACL . . . . .72 Clearing the ACL statistics. . . . . . . . . . . . . . . . . . . . . . . . .
Summary of the content on the page No. 7
Translation timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .104 Configuring the NAT translation aging timer . . . . . . . . . . . . . .104 Stateless static IP NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .105 Redundancy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .105 Enabling IP NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .106 Enabling static NAT redundancy . . .
Summary of the content on the page No. 8
Chapter 6 Secure Socket Layer (SSL) Acceleration SSL overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .135 Public Key Infrastructure (PKI) . . . . . . . . . . . . . . . . . . . . . . . . .135 Asymmetric cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136 Certificate Authority (CA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136 Certificate Revocation List (CRL) . . . . . . . . . . . . . . . . . . . . . . .136 Cipher
Summary of the content on the page No. 9
SSL debug and troubleshooting commands . . . . . . . . . . . . . . . . . .187 Diagnostics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .187 Displaying SSL information . . . . . . . . . . . . . . . . . . . . . . . . . . . .188 Displaying the status of a CRL record . . . . . . . . . . . . . . . . . . .191 Displaying socket information . . . . . . . . . . . . . . . . . . . . . . . . . . . . .199 Displaying SSL Statistics information. . . . . . . . . . . . . . . . .
Summary of the content on the page No. 10
xii ServerIron ADX Security Guide 53-1002440-03
Summary of the content on the page No. 11
About This Document Audience This document is designed for system administrators with a working knowledge of Layer 2 and Layer 3 switching and routing. If you are using a Brocade Layer 3 Switch, you should be familiar with the following protocols if applicable to your network – IP, RIP, OSPF, BGP, ISIS, IGMP, PIM, DVMRP, and VRRP. Supported hardware and software Although many different software and hardware configurations are tested and supported by Brocade Communications Systems, Inc. for 1
Summary of the content on the page No. 12
bold text Identifies command names Identifies the names of user-manipulated GUI elements Identifies keywords Identifies text to enter at the GUI or CLI italic text Provides emphasis Identifies variables Identifies document titles code text Identifies CLI output For readability, command names in the narrative portions of this guide are presented in bold: for example, show version. Notes, cautions, and danger notices The following notices and statements are used in this manual. They are listed be
Summary of the content on the page No. 13
Corporation Referenced Trademarks and Products Microsoft Corporation Windows NT, Windows 2000 The Open Group Linux Related publications The following Brocade documents supplement the information in this guide: • Release Notes for ServerIron Switch and Router Software TrafficWorks 12.2.00 • ServerIron ADX Graphical User Interface • ServerIron ADX Server Load Balancing Guide • ServerIron ADX Advanced Server Load Balancing Guide • ServerIron ADX Global Server Load Balancing Guide • ServerIron
Summary of the content on the page No. 14
xvi ServerIron ADX Security Guide 53-1002440-03
Summary of the content on the page No. 15
Chapter Network Security 1 TCP SYN attacks ServerIron software contains many intrusion detection and prevention capabilities. The ServerIron can be configured to defend against a variety of TCP SYN attacks, Denial of Service (DoS) attacks, and Smurf attacks. TCP SYN attacks disrupt normal traffic flow by exploiting the way TCP connections are established. When a normal TCP connection occurs, the connecting host first sends a TCP SYN packet to the destination host. The destination host (actu
Summary of the content on the page No. 16
1 Granular application of syn-proxy feature • ServerIron may accept the ACK during 33 seconds to 64 seconds due to the syn-proxy algorithm, but it does not accept the ACK after 64 seconds. • If you enter a value for the ip tcp syn-proxy command from the CLI or upgrade from an older release such as 09.4.x to 09.5.2a with the ip tcp syn-proxy command in the config file, you receive the following warning message. Warning: The value 10 is being ignored. Default ACK valid
Summary of the content on the page No. 17
Syn-def 1 ServerIronADX# show server traffic Client->Server = 0 Server->Client = 0 Drops = 0 Aged = 0 Fw_drops = 0 Rev_drops = 0 FIN_or_RST = 0 old-conn = 0 Disable_drop = 0 Exceed_drop = 0 Stale_drop = 0 Unsuccessful = 0 TCP SYN-DEF RST = 0 Server
Summary of the content on the page No. 18
1 No response to non-SYN first packet of a TCP flow SLB-chassis1/1#show server debug Generic Deug Info BP Distribution = Enabled JetCore = No No of BPs = 3 No of Partner BPs = 0 Partner Chassis MAC = 0000.0000.0000 Partner BP1 MAC = 0000.0000.0000 Partner BP2 MAC = 0000.0000.0000 Partner BP3 MAC = 0000.0000.0000 Partner BP4 MAC = 0000.0000.0000 Partner BP5 MAC = 0000.0000.0000 P
Summary of the content on the page No. 19
Prioritizing management traffic 1 By default, when ServerIron ADX receives TCP packet that is destined to VIP and there is no session match then it sends TCP reset to the sender. However, if one desires to remain passive then the above feature can be enabled. To not send the reset packet, use the following command. ServerIronADX(config)# server reset-on-syn-only To remove the configuration, use the following command. ServerIronADX(config)# no server reset-on-syn-only Syntax: [no] server rese
Summary of the content on the page No. 20
1 Peak BP utilization with TRAP ServerIronADX# server prioritize-mgmt-traffic 1.1.1.1 255.255.255.0 200.1.1.1 6 80 Prioritization of TCP port 80 traffic to management IP 200.1.1.1 from any source IP address ServerIronADX# server prioritize-mgmt-traffic any 200.1.1.1 6 80 Prioritization of UDP port 2222 traffic to management IP 200.1.1.1 ServerIronADX# server prioritize-mgmt-traffic 1.1.1.1 255.255.255.0 200.1.1.1 17 2222 Prioritization of IP protocol 89 (OSPF) traffic to management IP 200.1.1.
