ページ1に含まれる内容の要旨
53-1002440-03
®
June 2012
ServerIron ADX
Security Guide
Supporting Brocade ServerIron ADX version 12.4.00a
ページ2に含まれる内容の要旨
© 2012 Brocade Communications Systems, Inc. All Rights Reserved. Brocade, Brocade Assurance, the B-wing symbol, DCX, Fabric OS, MLX, SAN Health, VCS, and VDX are registered trademarks, and AnyIO, Brocade One, CloudPlex, Effortless Networking, ICX, NET Health, OpenScript, and The Effortless Network are trademarks of Brocade Communications Systems, Inc., in the United States and/or in other countries. Other brands, products, or service names mentioned may be trademarks of their respective owne
ページ3に含まれる内容の要旨
Contents About This Document Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Supported hardware and software . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Document conventions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Text formatting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Notes, cautions, and danger notices . . . . . . . . . . . . . . . . . . . . .
ページ4に含まれる内容の要旨
Transaction Rate Limit (TRL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Understanding transaction rate limit . . . . . . . . . . . . . . . . . . . . . . 7 Configuring transaction rate limit . . . . . . . . . . . . . . . . . . . . . . . . . 8 Configuring the maximum number of rules . . . . . . . . . . . . . . . .12 Saving a TRL configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13 Transaction rate limit command reference . . . . . . . . . . . . . . . .13
ページ5に含まれる内容の要旨
Firewall load balancing enhancements. . . . . . . . . . . . . . . . . . . . . . .34 Enabling firewall strict forwarding. . . . . . . . . . . . . . . . . . . . . . . .34 Enabling firewall VRRPE priority . . . . . . . . . . . . . . . . . . . . . . . . .34 Enabling track firewall group. . . . . . . . . . . . . . . . . . . . . . . . . . . .35 Enabling firewall session sync delay. . . . . . . . . . . . . . . . . . . . . .35 Syn-cookie threshhold trap. . . . . . . . . . . . . . . . . . . . . . . . . .
ページ6に含まれる内容の要旨
ACL logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .70 Displaying ACL log entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Displaying ACL statistics for flow-based ACLs . . . . . . . . . . . . . .72 Clearing flow-based ACL statistics . . . . . . . . . . . . . . . . . . . . . . .72 Dropping all fragments that exactly match a flow-based ACL . . . . .72 Clearing the ACL statistics. . . . . . . . . . . . . . . . . . . . . . . . .
ページ7に含まれる内容の要旨
Translation timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .104 Configuring the NAT translation aging timer . . . . . . . . . . . . . .104 Stateless static IP NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .105 Redundancy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .105 Enabling IP NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .106 Enabling static NAT redundancy . . .
ページ8に含まれる内容の要旨
Chapter 6 Secure Socket Layer (SSL) Acceleration SSL overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .135 Public Key Infrastructure (PKI) . . . . . . . . . . . . . . . . . . . . . . . . .135 Asymmetric cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136 Certificate Authority (CA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136 Certificate Revocation List (CRL) . . . . . . . . . . . . . . . . . . . . . . .136 Cipher
ページ9に含まれる内容の要旨
SSL debug and troubleshooting commands . . . . . . . . . . . . . . . . . .187 Diagnostics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .187 Displaying SSL information . . . . . . . . . . . . . . . . . . . . . . . . . . . .188 Displaying the status of a CRL record . . . . . . . . . . . . . . . . . . .191 Displaying socket information . . . . . . . . . . . . . . . . . . . . . . . . . . . . .199 Displaying SSL Statistics information. . . . . . . . . . . . . . . . .
ページ10に含まれる内容の要旨
xii ServerIron ADX Security Guide 53-1002440-03
ページ11に含まれる内容の要旨
About This Document Audience This document is designed for system administrators with a working knowledge of Layer 2 and Layer 3 switching and routing. If you are using a Brocade Layer 3 Switch, you should be familiar with the following protocols if applicable to your network – IP, RIP, OSPF, BGP, ISIS, IGMP, PIM, DVMRP, and VRRP. Supported hardware and software Although many different software and hardware configurations are tested and supported by Brocade Communications Systems, Inc. for 1
ページ12に含まれる内容の要旨
bold text Identifies command names Identifies the names of user-manipulated GUI elements Identifies keywords Identifies text to enter at the GUI or CLI italic text Provides emphasis Identifies variables Identifies document titles code text Identifies CLI output For readability, command names in the narrative portions of this guide are presented in bold: for example, show version. Notes, cautions, and danger notices The following notices and statements are used in this manual. They are listed be
ページ13に含まれる内容の要旨
Corporation Referenced Trademarks and Products Microsoft Corporation Windows NT, Windows 2000 The Open Group Linux Related publications The following Brocade documents supplement the information in this guide: • Release Notes for ServerIron Switch and Router Software TrafficWorks 12.2.00 • ServerIron ADX Graphical User Interface • ServerIron ADX Server Load Balancing Guide • ServerIron ADX Advanced Server Load Balancing Guide • ServerIron ADX Global Server Load Balancing Guide • ServerIron
ページ14に含まれる内容の要旨
xvi ServerIron ADX Security Guide 53-1002440-03
ページ15に含まれる内容の要旨
Chapter Network Security 1 TCP SYN attacks ServerIron software contains many intrusion detection and prevention capabilities. The ServerIron can be configured to defend against a variety of TCP SYN attacks, Denial of Service (DoS) attacks, and Smurf attacks. TCP SYN attacks disrupt normal traffic flow by exploiting the way TCP connections are established. When a normal TCP connection occurs, the connecting host first sends a TCP SYN packet to the destination host. The destination host (actu
ページ16に含まれる内容の要旨
1 Granular application of syn-proxy feature • ServerIron may accept the ACK during 33 seconds to 64 seconds due to the syn-proxy algorithm, but it does not accept the ACK after 64 seconds. • If you enter a value for the ip tcp syn-proxy command from the CLI or upgrade from an older release such as 09.4.x to 09.5.2a with the ip tcp syn-proxy command in the config file, you receive the following warning message. Warning: The value 10 is being ignored. Default ACK valid
ページ17に含まれる内容の要旨
Syn-def 1 ServerIronADX# show server traffic Client->Server = 0 Server->Client = 0 Drops = 0 Aged = 0 Fw_drops = 0 Rev_drops = 0 FIN_or_RST = 0 old-conn = 0 Disable_drop = 0 Exceed_drop = 0 Stale_drop = 0 Unsuccessful = 0 TCP SYN-DEF RST = 0 Server
ページ18に含まれる内容の要旨
1 No response to non-SYN first packet of a TCP flow SLB-chassis1/1#show server debug Generic Deug Info BP Distribution = Enabled JetCore = No No of BPs = 3 No of Partner BPs = 0 Partner Chassis MAC = 0000.0000.0000 Partner BP1 MAC = 0000.0000.0000 Partner BP2 MAC = 0000.0000.0000 Partner BP3 MAC = 0000.0000.0000 Partner BP4 MAC = 0000.0000.0000 Partner BP5 MAC = 0000.0000.0000 P
ページ19に含まれる内容の要旨
Prioritizing management traffic 1 By default, when ServerIron ADX receives TCP packet that is destined to VIP and there is no session match then it sends TCP reset to the sender. However, if one desires to remain passive then the above feature can be enabled. To not send the reset packet, use the following command. ServerIronADX(config)# server reset-on-syn-only To remove the configuration, use the following command. ServerIronADX(config)# no server reset-on-syn-only Syntax: [no] server rese
ページ20に含まれる内容の要旨
1 Peak BP utilization with TRAP ServerIronADX# server prioritize-mgmt-traffic 1.1.1.1 255.255.255.0 200.1.1.1 6 80 Prioritization of TCP port 80 traffic to management IP 200.1.1.1 from any source IP address ServerIronADX# server prioritize-mgmt-traffic any 200.1.1.1 6 80 Prioritization of UDP port 2222 traffic to management IP 200.1.1.1 ServerIronADX# server prioritize-mgmt-traffic 1.1.1.1 255.255.255.0 200.1.1.1 17 2222 Prioritization of IP protocol 89 (OSPF) traffic to management IP 200.1.1.
