Fortinet / Fortigate ICMP 3/3 Blacknurse vulnerable?

[kimahansen]

Hello,

"Blacknurse is a low bandwidth ICMP attack that is capable of doing denial of service to well known firewalls.

Most ICMP attacks that we see are based on ICMP Type 8 Code 0 also called a ping flood attack.

BlackNurse is based on ICMP with Type 3 Code 3 packets. We know that when a user has allowed ICMP Type 3 Code 3 to outside interfaces, the BlackNurse attack becomes highly effective even at low bandwidth.

Low bandwidth is in this case around 15-18 Mbit/s. This is to achieve the volume of packets needed which is around 40 to 50K packets per second. It does not matter if you have a 1 Gbit/s Internet connection."

Anyone care to comment this? Any comments on how to mitigate correctly?

Source:

http://blacknurse.dk/

Brgs,

Kim

[Andras]

Here's a custom IPS signature to mitigate the issue on FortiGate.

[kimahansen]

I have seen this article, but since the IPS functionality is located very late in the packet flow ingress, I have a hard time believing that this will actually protect the firewall's CPU from getting overloaded?

Can you confirm that this also protects the firewall and not only devices behind the firewall?

[Andras]

The IPS defends the systems behind the FW. The DoS policy (ICMP flood) should be set to protect the firewall. The only limitation on FortiGate is that DOS Policy applies to all ICMP traffic, not just Blacknurse.

For a more sophisticated solution you'll need the FortiDDOS.

[emnoc]

If your trying to defend against a low volume icmp-flood on the firewall  with a dos/ips sensor , you've  already lost in a small way.

The best way to mitigate this issues,  is with a upstream policer  that prevents less say   no more than 5-10% of the link speed with any ICMP packet.

yes apply a   policer-shaper with a set peak for imp at  5% of a 1gige link. We've been doing this type approach for years if not  decades. Also why on earth with anybody let 15-100mbps or icmp traffic into a network or to a single host for example.

just my 2cts 

Ken

[Andras]

Ken,

I agree with you on the upstream policer but it can't be set everywhere. E.g. think of a basic internet access; the provider won't set it for you, yet your FW is still exposed.

This is the order of packet processing on FortiGate:

[ol]

Receiving the packet on the ingress interface

DOS Policy

IP integrity checking

IPSec decapsulation

DNAT

Unicast RPF check

ALG (session helper)

Self (handling packets destined to the FW)

SSL VPN

Identity policy

Traffic shaping

Session management

FW policy lookup (within this: IPS checks)

Routing (i.e. finding the outgoing interface)

IPSec encapsulation

SNAT/PAT

Putting the packet on the egress interface[/ol]

As you can see, setting the DOS Policy is useful because that's the first thing that gets evaluated when a packet hits the FW, hence it protects the device. (Of course it requires CPU cycles but at least it's way before the complex checks.)

[emnoc]

Of course it requires CPU cycles but at least it's way before the complex checks.)

Your last line states why it's not effective. Not only  are you  wasting  CPU you wasted inbound BW that's not recovered. if you filter this upstream or at least at the  egress interface of the edge-router facing the security lan devices, you at least drop the traffic from hitting the security appliance

Look at this way, if I flood your WAN link with 50mbps or icmp just to hit a sensor to be drop, that 50mbps  of traffic still consumed bandwidth of your link.

Most modern edge routers have some ways to rate limit icmp messages  and specially destination  unreachable it so easily to apply and should be BCPs for now. Agin we've  been doing this in  the ISP/SP and DDoS arena for years if not decades and any half witted ISP/SP could easily deploy this on a  cisco device 

e.g  (  control what your router sends )

(cisco iOS )

config t

ip icmp rate-limit unreachable 100 1000

do copy run start

end

(cisco IOS-XR)

icmp ipv4 rate-limit unreachable 2000

commit

( junos)

you use a filter with drop as the action

A  simple egress policy with a drop on imp would drop anything that's being forward to the FW, hence protecting the firewall from a flood event w/icmp unreach

Also a NGFW is smart enough to session track or drop these type3 to a inside host if it tracks    sessions details  

just my 2cts  input 

Ken