Disabling Tcp Normalization; Preventing Ip Spoofing - Cisco 7604 Configuration Manual

Disabling TCP Normalization

hostname(config-cmap)# description "TCP traffic that bypasses stateful firewall"
hostname(config-cmap)# match access-list tcp_bypass
hostname(config-cmap)# policy-map tcp_bypass_policy
hostname(config-pmap)# class tcp_bypass
hostname(config-pmap-c)# set connection advanced-options tcp-state-bypass
hostname(config-pmap-c)# service-policy tcp_bypass_policy outside
Disabling TCP Normalization
For traffic that passes through the control-plane path, such as packets that require Layer 7 inspection or
management traffic, the FWSM sets the maximum number of out-of-order packets that can be queued
for a TCP connection to 2 packets, which is not user-configurable. Other TCP normalization features
that are supported on the PIX and ASA platforms are not enabled for FWSM. You can disable the limited
TCP normalization support for the FWSM using the no control-point tcp-normalizer command.

Preventing IP Spoofing

This section lets you enable Unicast Reverse Path Forwarding on an interface. Unicast RPF guards
against IP spoofing (a packet uses an incorrect source IP address to obscure its true source) by ensuring
that all packets have a source IP address that matches the correct source interface according to the
routing table.
Normally, the FWSM only looks at the destination address when determining where to forward the
packet. Unicast RPF instructs the FWSM to also look at the source address; this is why it is called
Reverse Path Forwarding. For any traffic that you want to allow through the FWSM, the FWSM routing
table must include a route back to the source address. See RFC 2267 for more information.
For outside traffic, for example, the FWSM can use the default route to satisfy the Unicast RPF
protection. If traffic enters from an outside interface, and the source address is not known to the routing
table, the FWSM uses the default route to correctly identify the outside interface as the source interface.
If traffic enters the outside interface from an address that is known to the routing table, but is associated
with the inside interface, then the FWSM drops the packet. Similarly, if traffic enters the inside interface
from an unknown source address, the FWSM drops the packet because the matching route (the default
route) indicates the outside interface.
Unicast RPF is implemented as follows:
•
•
To enable Unicast RPF, enter the following command:
hostname(config)# ip verify reverse-path interface interface_name
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
21-14
ICMP packets have no session, so each packet is checked.
UDP and TCP have sessions, so the initial packet requires a reverse route lookup. Subsequent
packets arriving during the session are checked using an existing state maintained as part of the
session. Non-initial packets are checked to ensure they arrived on the same interface used by the
initial packet.
Chapter 21 Configuring Advanced Connection Features
OL-20748-01