tailieunhanh - cisco press router security strategies phần 4

Trong viễn cảnh này, cổng mặc định chuyển tiếp các gói tin mà còn tạo ra một ICMP Redirect đến các máy chủ IP nguồn. Vì vậy, nơi hợp lý để áp dụng các ip không có chuyển hướng lệnh để giảm thiểu nguy cơ của ICMP chuyển hướng tấn công vào | 180 Chapter 4 IP Data Plane Security and default gateways typically do not exchange routing protocol information and because ICMP Redirects are generated only if the source of the original packet is directly connected. An IP host s statically or DHCP assigned default gateway may not provide the best path to a remote destination. In these scenarios the default gateway forwards the packet but also generates an ICMP Redirect to the source IP host. Therefore the logical place to apply the no ip redirects command to mitigate the risk of ICMP Redirect attacks is on router interfaces that do not provide default gateway services via a shared LAN. Disabling ICMP redirects on shared LAN default gateway router interfaces is also an option and is often considered a best practice to prevent the generation of ICMP redirect messages from impacting the IOS process level. Example 4-13 illustrates the Cisco IOS CLI used to disable the generation of ICMP Redirect messages on an Ethernet interface. Example 4-13 Configuration for no ip redirects Interface Command interface Ethernet 0 no ip redirects Note More information on the generation of ICMP Redirect messages may be found in the document When Are ICMP Redirects Sent see the Further Reading section . IP packet with parameter problem Per RFC 792 if an IP router receives a packet with an IP header problem and discards the packet it must generate an ICMP Parameter Problem Type 12 message. These are only sent if the IP packet is discarded. The default behavior within IOS is to generate such ICMP Parameter Problem messages and there is no CLI to disable this behavior. CoPP may be used to limit the impact of DoS attacks using IP packets with parameter problems. For further information on CoPP refer to Chapter 5. Note that such attacks generally apply only to first-hop default gateway routers because they would first encounter and discard such malformed packets rather than forward them downstream. Hence default gateway routers .