Verifying a TCP and ICMP Flood Firewall Filter

Purpose

Verify the stateless firewall filter configured in Configuring a Routing Engine Firewall Filter to Protect Against TCP and ICMP Floods.

Action

To verify that the actions of the firewall filter terms are taken, send packets to the Services Router that match the terms. In addition, verify that the filter actions are not taken for packets that do not match.

• Verify that the Services Router can establish only TCP sessions with a host at an IP address that matches 192.168.122.0/24 or 10.2.1.0/24. For example, log in to the router with the telnet host-name command from another host with one of these address prefixes.
• Use the ping host-name command to verify that the Services Router responds only to ICMP packets (such as ping requests) that do not exceed the policer traffic rates.
• Use the ping host-name size bytes command to exceed the policer traffic rates by sending ping requests with large data payloads.

Trying 192.168.249.71...
Connected to host.acme.net.
Escape character is '^]'.

host (ttyp0)

login: user
Password:

--- JUNOS 6.4-20040521.1 built 2004-05-21 09:38:12 UTC

user@host> 

PING host-ge-000.acme.net (192.168.249.71): 56 data bytes
64 bytes from 192.168.249.71: icmp_seq=0 ttl=253 time=11.946 ms
64 bytes from 192.168.249.71: icmp_seq=1 ttl=253 time=19.474 ms
64 bytes from 192.168.249.71: icmp_seq=2 ttl=253 time=14.639 ms
...

PING host-ge-000.acme.net (192.168.249.71): 20000 data bytes
^C
--- host-ge-000.acme.net ping statistics ---
12 packets transmitted, 0 packets received, 100% packet loss

What it Means

Verify the following information:

• You can successfully log in to the Services Router using Telnet.
• The Services Router sends responses to the ping host command.
• The Services Router does not send responses to the ping host size 20000 command.

See Also