| Description | This article describes how to configure TTL security policy for BGP. |
| Scope | FortiGate. |
| Solution |
Problem. Referring to the image below, even though 10.122.2.155 is not a valid eBGP neighbor, 10.1.1.1 still responded SYN-ACK packets to the SYN packet sent by the former. This opens up the device for CPU-utilization based attacks.
To avoid such vulnerability to be exploited, one method is to use TTL Security Policy.
In this example, BGP communication below TTL 253 is not to be expected. However, it is notable that the rogue router has a TTL of 251.
Considering the scenario, the following has been configured to mitigate this vulnerability.
# config firewall ttl-policy
10.1.1.1 is not responding to the SYN packets anymore sent by rogue. router. 
For more information regarding TTL Security Mechanism, refer to: |
