Cisco 4700M Configuration Manual page 295

Chapter 4 Configuring TCP/IP Normalization and IP Reassembly Parameters
Configuration and Operational Considerations
OL-16202-01
An encoding of the client MSS, which the ACE forwards to the server.
•
An ACE-selected secret that is calculated from the 4-tuple (source IP address,
•
source port, destination IP address, and destination port) and the timer value.
Normally, if the SYN queue fills up, the ACE drops additional connection
requests. If the SYN queue fills up on the ACE with SYN cookies enabled, the
ACE continues to service a client request normally by sending a SYN-ACK to the
requesting client as if the SYN queue was actually larger. The ACE uses the
calculated SYN cookie value as the sequence number (n) and discards the SYN
queue entry.
When it receives an ACK (sequence number = n+1) from the client, the ACE
verifies the validity of the secret and the SYN cookie value for a recent value of
the SYN cookie timer. If the secret or the sequence number is not valid, the ACE
drops the packet. If the secret and the sequence number are valid, the ACE
rebuilds the SYN queue entry based on the encoded MSS and the ACK from the
client. At this point, the connection process proceeds normally; the ACE sends the
newly built SYN to the server and establishes the back-end TCP connection.
When you use the SYN cookie feature, be aware of the following considerations:
• If the server drops the SYN that is sent by the ACE, the ACE resets the
connection using the embryonic timeout. It does not retry the SYN packet.
A SYN cookie supports only the MSS TCP option. The ACE ignores all other
•
TCP options, even if there are problems with those other options.
The ACE returns an MSS of 536 to the client, which is the RFC-specified
•
default.
If you use a parameter map to specify the minimum and maximum MSS
•
values, the ACE ignores those values.
Disabling normalization and using a SYN cookie concurrently may result in
•
unpredictable behavior.
The ACE does not generate any syslogs for a SYN cookie, even if the number
•
of embryonic connections exceeds the configured threshold, which may
indicate a SYN-flood attack.
Cisco 4700 Series Application Control Engine Appliance Security Configuration Guide
Configuring Interface Normalization Parameters
4-37