Discussion

list of IP addresses in one place in the configuration. The ssh-prefixes list has all the
SSH servers in your network, and the bgp-prefixes list has all your BGP peers. The
last from clause command matches bits found in TCP control traffic. The first option,
(syn & !ack), matches TCP synchronize packets that are being used to establish connections.
For connections that are already established and operating normally, these
packets also have the ACK bit set, so we exclude these packets from the policer limits.
The RST option is present in packets resetting a TCP session, and FIN indicates
that a session has closed and there is no more data from the sender. You must
enclose the bits in quotation marks so the CLI interprets them correctly. The final
two commands in this term configure the action. The first command applies the tcp
policer, and the second accepts the packets.
After the tcp term, you should add the following filter term to accept BGP traffic
from trusted sources:
[edit firewall filter protect-RE2]
aviva@RouterF# set term bgp from source-prefix-list bgp-prefixes
aviva@RouterF# set term bgp from protocol tcp
aviva@RouterF# set term bgp from port bgp
aviva@RouterF# set term bgp then accept
The first three commands match packets from a prefix list configured in the [edit
policy] section that lists the router’s BGP peers, and this traffic is TCP protocol traffic
sent from the BGP port. The then clause accepts these packets. You don’t ratelimit
BGP traffic, because it must be received and handled by the Routing Engine.
The ssh, utility, and icmp terms in the filter are similar, accepting and rate-limiting
SSH, SNMP, NTP, RADIUS, and ICMP packets. The last term, final-term, counts
and discards all remaining traffic.
Finally, to have the filter take effect, apply it to the lo0 interface.
9.17 Using Counters to Determine Whether a Router
Is Under Attack
Problem
You want to count traffic on an interface to help determine whether a router is under
attack.
Solution
If you suspect that an attack includes TCP packets, add a counter to the firewall term
that counts all TCP traffic:
[edit firewall filter protect-RE2]
aviva@RouterF# set term tcp then count tcp-counter
Using Counters to Determine Whether a Router Is Under Attack | 329
This is the Title of the Book, eMatter Edition
Copyright © 2008 O’Reilly & Associates, Inc. All rights reserved.