Rate Limiting for DoS Mitigation

Overview

Rate Limiting is a defense against DoS (Denial of Service) attacks. A rule-based policy limits traffic coming from specific sources and using specific services.

Rate limiting is enforced on:

• Bandwidth and packet rate
• Number of concurrent connections
• Connection rate

Rate Limiting for DoS Mitigation is scalable and can support a large number of rules. You can define policies that limit bandwidth for the traffic coming from geographic sources that are outside of normal business profiles. It also provides monitoring and whitelisting bypass capabilities.

VSX and Rate Limiting for DoS Mitigation

This feature is supported in R77.20 and higher.

VSX supports all the Rate Limiting features and functionality. You can configure different settings for the Virtual Systems or global parameters for all of them.

For R77.10 and lower, you can configure only the VSX Gateway (VS0).

Configuring Rate Limiting for DoS Mitigation

To prevent Denial of Service (DoS) attacks, add rules to a policy one at a time, or in batch mode.

If this gateway is a cluster member, configure Rate Limiting for DoS Mitigation on all of the cluster members.

Adding One Rule at a Time

To add a rule to the policy:

fw samp add -a d|n|b [-l r] [-t TIMEOUT] [-n NAME] [-c COMMENT] [-o ORIGINATOR] quota KEY VALUE [KEY VALUE ...KEY VALUE]

Here are some rule examples.

Example of a rule with a range:

fw samp add -a d -l r -t 3600 quota service any source 
range:172.16.7.11-172.16.7.13 new-conn-rate 5 flush true

• Limits the rate of creation of new connection for the IP addresses in the range 172.16.7.11-172.16.7.13 to 5 per second. Drops all other attempted connections (-a d).
• Logs packets that exceed the quota set by the rule. Note: The limit of the total number of log entries per second is set through the global parameter sim_dos ctl -l LOG-LIMIT. Refer to the Global Parameters section for more information.
• The rule will expire in one hour (3600 seconds).
• This rule will be compiled and loaded on the Performance Pack, together with other rules in the Suspicious Activity Monitoring policy database, immediately because this rule includes the flush true parameter.

Example of a rule with a service specification:

fw samp add -a n -l r quota service 1,50-51,6/443,17/53 
service-negated true source cc:QQ byte-rate 0

• Logs all packets (-a n) coming from IP addresses that are assigned to the country with specified country code (cc:QQ).
• Does not let any traffic through (byte-rate 0) except for the packets (service-negated true source) that match the IP protocols on the list:
  • 1 - ICMP
  • 50-51 - IPsec
  • 6/443 - HTTPS
  • 17/53 - DNS
• The rule will not expire (TIMEOUT parameter is not specified). To cancel it, you must delete it explicitly.
• This rule will not be compiled and installed on the Performance Pack immediately because it does not include the flush true parameter.

Example of a rule with ASN:

fw samp -a d quota source asn:AS64500,cidr:[::ffff:c0a8:1100]/120 
service any pkt-rate 0

• Drops all packets (-a d) with the source IP address in the IPv6 address block (cidr:[::ffff:c0a8:1100]/120), from the autonomous system number 64500 (asn:AS64500)
• The rule will not expire (TIMEOUT parameter is not specified). To cancel it, you must delete it explicitly.
• This rule will not be compiled and installed on the Performance Pack immediately because it does not include the flush true parameter.

Example of a whitelist rule:

fw samp add -a b quota source range:172.16.8.17-172.16.9.121 
service 6/80

• Ignores all other quota type of rules that match the traffic (-a b), and lets through all HTTP traffic (service 6/80) from the specified address range (source range:172.16.8.17-172.16.9.121).

  Note: the Firewall and other types of security policy rules still apply.

• The rule will not expire (TIMEOUT parameter is not specified). To cancel it, you must delete it explicitly.
• This rule will not be compiled and installed on the Performance Pack immediately because it does not include the flush true parameter.

Example of a tracked rule:

fw samp add -a d quota service any source-negated true source 
cc:QQ concurrent-conns-ratio 655 track source

• Drops (-a d) new connections for every IP address that already has more than approximately 1% (655/65536) of all existing connections (concurrent-conns-ratio 655).
• Defines IP addresses that are assigned to a specific country (source-negated true source cc:QQ) as exception to the rule.
• Does not log any entries (does not include -l parameter).
• The rule will not expire (TIMEOUT parameter is not specified). To cancel it, you must delete it explicitly.
• This rule will not be compiled and installed on the Performance Pack immediately because it does not include the flush true parameter.

Adding Rules in Batch Mode

To add rules in batch mode:

1. Type this command to start fw samp batch:

   fw samp [-S IP_ADDRESS] batch <<EOF

   Note: if you include the -s parameter, all the commands in this batch will apply to the specified gateway.

2. Enter one add or delete command per line on as many lines as necessary. Start each line with add or del parameter, and not with fw samp. Use the same set of parameters and values as for the individual rules. Terminate each line with a Return (ASCII 10 - Line Feed) character:

   add -a d|n|b[-l r] [-t TIMEOUT] [-n NAME] [-c COMMENT] [-o ORIGINATOR] quota KEY VALUE KEY VALUE.

   del UID

3. To end the batch, type: EOF.

Example:

fw samp -S 192.168.37.5 batch <<EOF

add -a d -l r -t 3600 -c a\ comment quota service any source 
range:172.16.7.13-172.16.7.13 new-conn-rate 5

del <501f6ef0,00000000,cb38a8c0,0a0afffe>

add -a b quota source range:172.16.8.17-172.16.9.121 service 6/80

EOF

This batch applies two add commands and one delete command to a gateway with the IP address 192.168.37.5. For details on add command syntax, see Adding One Rule at a Time.

Deleting a Rule

To delete a rule:

1. List all the rules in the Suspicious Activity Monitoring policy database:

   fw samp get

   The rules show in this format:

   ... operation=add uid=<501f6ef0,00000000,cb38a8c0,0a0afffe> target=all timeout=... action=... ... ...

2. Delete a rule from the list:

   fw samp del '<501f6ef0,00000000,cb38a8c0,0a0afffe>'

3. Enter this flush-only add rule:

   fw samp add -t 2 quota flush true

   This immediately deletes the rule, and times out in 2 seconds. It is a good practice to specify a short timeout period for the flush-only rules. This prevents accumulation of rules that are obsolete in the database.

   The fw samp del command removes a rule from the persistent database only. The deleted rule continues to be enforced until the next time a policy is compiled and loaded. To force the rule deletion immediately, you must enter a flush-only add rule right after the fw samp del command.

Configuring Rules with VSX

This feature is supported in R77.20 and higher.

Use the fw samp command to add rules to a Virtual System. You can run the command on the local gateway, or remotely configure the rules.

To configure rules on a local gateway:

1. Log in to the gateway CLI.
2. Set the environment for the specified Virtual System, run set virtual-system <vsid>
3. Run fw samp and configure one or more Rate Limiting rules.

   The previous sections explain how to add or delete rules.

To configure rules on a remote gateway:

1. Log in to the server CLI.
2. Run fw samp and with these parameters and configure one or more Rate Limiting rules.
   • -S <server_IP> - Use the IP address of the VSX Gateway
   • -s <VS_SIC_name> - Use the name of the Virtual System that established SIC

   Run fw vsx showncs -vs <VSID> to show the SIC name for the Virtual System.

   The previous sections explain how to add or delete rules.

Configuring Global Parameters

There are several global parameters that you can configure with sim_dos ctl command for IPv4 addresses and with sim6_dos ctl for IPv6 addresses. They apply to all the policy rules.

Use the sim_dos ctl or sim6_dos ctl command with the parameters and values below:

The global parameters return to their default values every time the DoS in the Performance Pack module is initialized. This happens on every reboot. To keep the changes to global parameters until you decide to change them again, include the sim_dos ctl (or sim6_dos ctl) command in the dospreload script:

For IPv4:

$ cat >$PPKDIR/bin/dospreload4 <<EOF

#!/bin/bash

$PPKDIR/bin/sim_dos ctl -m 1 -x 0 -l 30

EOF

$ chmod +x $PPKDIR/bin/dospreload4

For IPv6:

$ cat >$PPKDIR/bin/dospreload6 <<EOF

#!/bin/bash

$PPKDIR/bin/sim6_dos ctl -m 1 -x 0 -l 30

EOF

$ chmod +x $PPKDIR/bin/dospreload6

For VSX:

Rate Limiting for VSX is supported in R77.20 and higher.

• $PPKDIR/bin/ is shared by all the Virtual Systems
• $FWDIR/scripts/ is specific for each Virtual System

Run these commands from Expert mode to apply monitor only mode (-m 1) to all Virtual Systems.

# cat > $PPKDIR/bin/dospreload4 << EOF

#!/bin/bash

sim_dos ctl -m 1

if test -x $FWDIR/scripts/dospreload4; then

	$FWDIR/scripts/dospreload4

fi

EOF

# chmod +x $PPKDIR/bin/dospreload4

Run these commands from Expert mode to limit the number of log entries (-l 40) for the Virtual System with VSID 2.

# vsenv 2

Context is set to Virtual Device myVS-2 (ID 2).

# cat > $FWDIR/scripts/dospreload4 <<EOF

#!/bin/bash

sim_dos ctl -l 40

EOF

# chmod +x $FWDIR/scripts/dospreload4

Run similar commands to create $PPKDIR/bin/dospreload6 and a $FWDIR/scripts/dospreload6 script for each Virtual System.

Monitoring Events Related to DoS Mitigation

To see some useful information related to DoS Mitigation, run these commands: