Hello,
"Blacknurse is a low bandwidth ICMP attack that is capable of doing denial of service to well known firewalls.
Most ICMP attacks that we see are based on ICMP Type 8 Code 0 also called a ping flood attack.
BlackNurse is based on ICMP with Type 3 Code 3 packets. We know that when a user has allowed ICMP Type 3 Code 3 to outside interfaces, the BlackNurse attack becomes highly effective even at low bandwidth.
Low bandwidth is in this case around 15-18 Mbit/s. This is to achieve the volume of packets needed which is around 40 to 50K packets per second. It does not matter if you have a 1 Gbit/s Internet connection."
Anyone care to comment this? Any comments on how to mitigate correctly?
Source:
Brgs,
Kim
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Here's a custom IPS signature to mitigate the issue on FortiGate.
I have seen this article, but since the IPS functionality is located very late in the packet flow ingress, I have a hard time believing that this will actually protect the firewall's CPU from getting overloaded?
Can you confirm that this also protects the firewall and not only devices behind the firewall?
The IPS defends the systems behind the FW. The DoS policy (ICMP flood) should be set to protect the firewall. The only limitation on FortiGate is that DOS Policy applies to all ICMP traffic, not just Blacknurse.
For a more sophisticated solution you'll need the FortiDDOS.
If your trying to defend against a low volume icmp-flood on the firewall with a dos/ips sensor , you've already lost in a small way.
The best way to mitigate this issues, is with a upstream policer that prevents less say no more than 5-10% of the link speed with any ICMP packet.
yes apply a policer-shaper with a set peak for imp at 5% of a 1gige link. We've been doing this type approach for years if not decades. Also why on earth with anybody let 15-100mbps or icmp traffic into a network or to a single host for example.
just my 2cts
Ken
PCNSE
NSE
StrongSwan
Ken,
I agree with you on the upstream policer but it can't be set everywhere. E.g. think of a basic internet access; the provider won't set it for you, yet your FW is still exposed.
This is the order of packet processing on FortiGate:
[ol]
As you can see, setting the DOS Policy is useful because that's the first thing that gets evaluated when a packet hits the FW, hence it protects the device. (Of course it requires CPU cycles but at least it's way before the complex checks.)
Of course it requires CPU cycles but at least it's way before the complex checks.)
Your last line states why it's not effective. Not only are you wasting CPU you wasted inbound BW that's not recovered. if you filter this upstream or at least at the egress interface of the edge-router facing the security lan devices, you at least drop the traffic from hitting the security appliance
Look at this way, if I flood your WAN link with 50mbps or icmp just to hit a sensor to be drop, that 50mbps of traffic still consumed bandwidth of your link.
Most modern edge routers have some ways to rate limit icmp messages and specially destination unreachable it so easily to apply and should be BCPs for now. Agin we've been doing this in the ISP/SP and DDoS arena for years if not decades and any half witted ISP/SP could easily deploy this on a cisco device
e.g ( control what your router sends )
(cisco iOS )
config t
ip icmp rate-limit unreachable 100 1000
do copy run start
end
(cisco IOS-XR)
icmp ipv4 rate-limit unreachable 2000
commit
( junos)
you use a filter with drop as the action
A simple egress policy with a drop on imp would drop anything that's being forward to the FW, hence protecting the firewall from a flood event w/icmp unreach
Also a NGFW is smart enough to session track or drop these type3 to a inside host if it tracks sessions details
just my 2cts input
Ken
PCNSE
NSE
StrongSwan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1702 | |
1092 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.