Resumo do conteúdo contido na página número 1
53-1002440-03
®
June 2012
ServerIron ADX
Security Guide
Supporting Brocade ServerIron ADX version 12.4.00a
Resumo do conteúdo contido na página número 2
© 2012 Brocade Communications Systems, Inc. All Rights Reserved. Brocade, Brocade Assurance, the B-wing symbol, DCX, Fabric OS, MLX, SAN Health, VCS, and VDX are registered trademarks, and AnyIO, Brocade One, CloudPlex, Effortless Networking, ICX, NET Health, OpenScript, and The Effortless Network are trademarks of Brocade Communications Systems, Inc., in the United States and/or in other countries. Other brands, products, or service names mentioned may be trademarks of their respective owne
Resumo do conteúdo contido na página número 3
Contents About This Document Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Supported hardware and software . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Document conventions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Text formatting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii Notes, cautions, and danger notices . . . . . . . . . . . . . . . . . . . . .
Resumo do conteúdo contido na página número 4
Transaction Rate Limit (TRL) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Understanding transaction rate limit . . . . . . . . . . . . . . . . . . . . . . 7 Configuring transaction rate limit . . . . . . . . . . . . . . . . . . . . . . . . . 8 Configuring the maximum number of rules . . . . . . . . . . . . . . . .12 Saving a TRL configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . .13 Transaction rate limit command reference . . . . . . . . . . . . . . . .13
Resumo do conteúdo contido na página número 5
Firewall load balancing enhancements. . . . . . . . . . . . . . . . . . . . . . .34 Enabling firewall strict forwarding. . . . . . . . . . . . . . . . . . . . . . . .34 Enabling firewall VRRPE priority . . . . . . . . . . . . . . . . . . . . . . . . .34 Enabling track firewall group. . . . . . . . . . . . . . . . . . . . . . . . . . . .35 Enabling firewall session sync delay. . . . . . . . . . . . . . . . . . . . . .35 Syn-cookie threshhold trap. . . . . . . . . . . . . . . . . . . . . . . . . .
Resumo do conteúdo contido na página número 6
ACL logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .70 Displaying ACL log entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Displaying ACL statistics for flow-based ACLs . . . . . . . . . . . . . .72 Clearing flow-based ACL statistics . . . . . . . . . . . . . . . . . . . . . . .72 Dropping all fragments that exactly match a flow-based ACL . . . . .72 Clearing the ACL statistics. . . . . . . . . . . . . . . . . . . . . . . . .
Resumo do conteúdo contido na página número 7
Translation timeouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .104 Configuring the NAT translation aging timer . . . . . . . . . . . . . .104 Stateless static IP NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .105 Redundancy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .105 Enabling IP NAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .106 Enabling static NAT redundancy . . .
Resumo do conteúdo contido na página número 8
Chapter 6 Secure Socket Layer (SSL) Acceleration SSL overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .135 Public Key Infrastructure (PKI) . . . . . . . . . . . . . . . . . . . . . . . . .135 Asymmetric cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136 Certificate Authority (CA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .136 Certificate Revocation List (CRL) . . . . . . . . . . . . . . . . . . . . . . .136 Cipher
Resumo do conteúdo contido na página número 9
SSL debug and troubleshooting commands . . . . . . . . . . . . . . . . . .187 Diagnostics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .187 Displaying SSL information . . . . . . . . . . . . . . . . . . . . . . . . . . . .188 Displaying the status of a CRL record . . . . . . . . . . . . . . . . . . .191 Displaying socket information . . . . . . . . . . . . . . . . . . . . . . . . . . . . .199 Displaying SSL Statistics information. . . . . . . . . . . . . . . . .
Resumo do conteúdo contido na página número 10
xii ServerIron ADX Security Guide 53-1002440-03
Resumo do conteúdo contido na página número 11
About This Document Audience This document is designed for system administrators with a working knowledge of Layer 2 and Layer 3 switching and routing. If you are using a Brocade Layer 3 Switch, you should be familiar with the following protocols if applicable to your network – IP, RIP, OSPF, BGP, ISIS, IGMP, PIM, DVMRP, and VRRP. Supported hardware and software Although many different software and hardware configurations are tested and supported by Brocade Communications Systems, Inc. for 1
Resumo do conteúdo contido na página número 12
bold text Identifies command names Identifies the names of user-manipulated GUI elements Identifies keywords Identifies text to enter at the GUI or CLI italic text Provides emphasis Identifies variables Identifies document titles code text Identifies CLI output For readability, command names in the narrative portions of this guide are presented in bold: for example, show version. Notes, cautions, and danger notices The following notices and statements are used in this manual. They are listed be
Resumo do conteúdo contido na página número 13
Corporation Referenced Trademarks and Products Microsoft Corporation Windows NT, Windows 2000 The Open Group Linux Related publications The following Brocade documents supplement the information in this guide: • Release Notes for ServerIron Switch and Router Software TrafficWorks 12.2.00 • ServerIron ADX Graphical User Interface • ServerIron ADX Server Load Balancing Guide • ServerIron ADX Advanced Server Load Balancing Guide • ServerIron ADX Global Server Load Balancing Guide • ServerIron
Resumo do conteúdo contido na página número 14
xvi ServerIron ADX Security Guide 53-1002440-03
Resumo do conteúdo contido na página número 15
Chapter Network Security 1 TCP SYN attacks ServerIron software contains many intrusion detection and prevention capabilities. The ServerIron can be configured to defend against a variety of TCP SYN attacks, Denial of Service (DoS) attacks, and Smurf attacks. TCP SYN attacks disrupt normal traffic flow by exploiting the way TCP connections are established. When a normal TCP connection occurs, the connecting host first sends a TCP SYN packet to the destination host. The destination host (actu
Resumo do conteúdo contido na página número 16
1 Granular application of syn-proxy feature • ServerIron may accept the ACK during 33 seconds to 64 seconds due to the syn-proxy algorithm, but it does not accept the ACK after 64 seconds. • If you enter a value for the ip tcp syn-proxy command from the CLI or upgrade from an older release such as 09.4.x to 09.5.2a with the ip tcp syn-proxy command in the config file, you receive the following warning message. Warning: The value 10 is being ignored. Default ACK valid
Resumo do conteúdo contido na página número 17
Syn-def 1 ServerIronADX# show server traffic Client->Server = 0 Server->Client = 0 Drops = 0 Aged = 0 Fw_drops = 0 Rev_drops = 0 FIN_or_RST = 0 old-conn = 0 Disable_drop = 0 Exceed_drop = 0 Stale_drop = 0 Unsuccessful = 0 TCP SYN-DEF RST = 0 Server
Resumo do conteúdo contido na página número 18
1 No response to non-SYN first packet of a TCP flow SLB-chassis1/1#show server debug Generic Deug Info BP Distribution = Enabled JetCore = No No of BPs = 3 No of Partner BPs = 0 Partner Chassis MAC = 0000.0000.0000 Partner BP1 MAC = 0000.0000.0000 Partner BP2 MAC = 0000.0000.0000 Partner BP3 MAC = 0000.0000.0000 Partner BP4 MAC = 0000.0000.0000 Partner BP5 MAC = 0000.0000.0000 P
Resumo do conteúdo contido na página número 19
Prioritizing management traffic 1 By default, when ServerIron ADX receives TCP packet that is destined to VIP and there is no session match then it sends TCP reset to the sender. However, if one desires to remain passive then the above feature can be enabled. To not send the reset packet, use the following command. ServerIronADX(config)# server reset-on-syn-only To remove the configuration, use the following command. ServerIronADX(config)# no server reset-on-syn-only Syntax: [no] server rese
Resumo do conteúdo contido na página número 20
1 Peak BP utilization with TRAP ServerIronADX# server prioritize-mgmt-traffic 1.1.1.1 255.255.255.0 200.1.1.1 6 80 Prioritization of TCP port 80 traffic to management IP 200.1.1.1 from any source IP address ServerIronADX# server prioritize-mgmt-traffic any 200.1.1.1 6 80 Prioritization of UDP port 2222 traffic to management IP 200.1.1.1 ServerIronADX# server prioritize-mgmt-traffic 1.1.1.1 255.255.255.0 200.1.1.1 17 2222 Prioritization of IP protocol 89 (OSPF) traffic to management IP 200.1.1.
