Cisco 7609 User Manual

24-3
Cisco 7600 Series Router Cisco IOS Software Configuration Guide—12.1E
78-14064-04
Chapter 24 Configuring Denial of Service Protection
Configuring DoS Protection
When using security ACLs to drop DoS packets, note the following information:
• The security ACL must specify the traffic flow to be dropped.
• When adding a security ACL to block DoS packets to an interface that already has a security ACL
configured, you must merge the DoS security ACL with the existing security ACL.
• Security ACLs need to be configured on all external interfaces that require protection. Use the
interface range command to configure a security ACL on multiple interfaces.
The following example shows how a security ACL is used to drop DoS packets:
Router# clear mls ip mod 9
Router# show mls ip mod 9
Displaying Netflow entries in module 9
DstIP SrcIP Prot:SrcPort:DstPort Src i/f:AdjPtr
--------------------------------------------------------------------
Pkts Bytes Age LastSeen Attributes
---------------------------------------------------
199.1.1.1 199.2.1.1 0 :0 :0 0 : 0
1843 84778 2 02:30:17 L3 - Dynamic
199.2.1.1 199.1.1.1 0 :0 :0 0 : 0
2742416 126151136 2 02:30:17 L3 - Dynamic traffic flow identified
Router# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# no access-list 199
Router(config)# access-list 199 deny ip host 199.1.1.1 any
Router(config)# access-list 199 permit ip any any
Router(config)# interface g9/1
Router(config-if)# ip access 199 in security ACL applied
Router(config-if)# end
Router#
1w6d: %SYS-5-CONFIG_I: Configured from console by console
Router# clear mls ip mod 9
Router# show mls ip mod 9
Displaying Netflow entries in module 9
DstIP SrcIP Prot:SrcPort:DstPort Src i/f:AdjPtr
--------------------------------------------------------------------
Pkts Bytes Age LastSeen Attributes
---------------------------------------------------
199.1.1.1 199.2.1.1 0 :0 :0 0 : 0
1542 70932 2 02:31:56 L3 - Dynamic
199.2.1.1 199.1.1.1 0 :0 :0 0 : 0
0 0 2 02:31:56 L3 - Dynamic hardware-forwarded
traffic stopped
Extended IP access list 199
deny ip host 199.1.1.1 any (100 matches)
permit ip any any
Router# show access-list 199
Extended IP access list 199
deny ip host 199.1.1.1 any (103 matches rate limiting at 0.5 pps
permit ip any any
Router #

Cisco 7609 Specifications

General

Chassis Slots	9
Switch Fabric Capacity	720 Gbps
Power Supply Options	AC or DC
Product Type	Router
Form Factor	Rack-mountable
Supported Line Cards	Various Cisco 7600 Series line cards
Operating System	Cisco IOS
Management	CLI, SNMP
Forwarding Performance	400 Mpps
Maximum Power Consumption	4000 Watts
Redundancy	Yes
Interfaces/Ports	Various, depending on line cards installed