本主题介绍如何配置 IP 泪滴攻击检测。
泪滴攻击利用分段 IP 数据包的重组。在 IP 报头中,其中一个字段是分片偏移量字段,它指示分片数据包中包含的数据相对于原始未分片数据包数据的起始位置或偏移量。当一个分片数据包的偏移量和大小之和与下一个分片数据包的偏移量和大小之和不同时,数据包将重叠,并且尝试重组数据包的服务器可能会崩溃。
- 配置接口并为接口分配 IP 地址。
[edit]
user@host# set interfaces ge-0/0/1 unit 0 family inet address 192.0.2.0/24
user@host# set interfaces ge-0/0/3 unit 0 family inet address 198.51.100.0/24
- 配置安全区域 trustZone 并 untrustZone 为其分配接口。
[edit]
user@host# set security zones security-zone trustZone host-inbound-traffic system-services all
user@host# set security zones security-zone trustZone host-inbound-traffic protocols all
user@host# set security zones security-zone trustZone interfaces ge-0/0/1.0
user@host# set security zones security-zone untrustZone host-inbound-traffic system-services all
user@host# set security zones security-zone untrustZone host-inbound-traffic protocols all
user@host# set security zones security-zone untrustZone interfaces ge-0/0/3.0
- 从 untrustZone 到 配置 trustZone安全策略。
[edit]
user@host# set security policies from-zone untrustZone to-zone trustZone policy policy1 match source-address any
user@host# set security policies from-zone untrustZone to-zone trustZone policy policy1 match destination-address any
user@host# set security policies from-zone untrustZone to-zone trustZone policy policy1 match application any
user@host# set security policies from-zone untrustZone to-zone trustZone policy policy1 then permit
user@host# set security policies default-policy deny-all
- 配置安全屏幕选项并将其附加到 untrustZone.
[edit]
user@host# set security screen ids-option untrustScreen ip tear-drop
user@host# set security zones security-zone untrustZone screen untrustScreen
user@host# set security screen ids-option untrustScreen alarm-without-drop
- 配置系统日志。
[edit]
user@host# set system syslog file syslog any any
user@host# set system syslog file syslog archive size 10000000
user@host# set system syslog file syslog structured-data
user@host# set security policies from-zone untrustZone to-zone trustZone policy policy1 then log session-init
user@host# set security policies from-zone untrustZone to-zone trustZone policy policy1 then log session-close
- 提交配置。