IP Fragment Filtering

Written by Rene Molenaar on 04 October 2011. Posted in Security

Scenario:

As part of the security team you are always looking for ways to improve security within the company. You heard bad things about fragmented IP packets being a security risk to your network. You decide to block them using an access-list.

Goal:

All IP addresses have been configured for you, look at the topology picture for the IP addresses.
OSPF has been preconfigured for you.
Configure router Mirror so IP fragments from network 1.1.1.0 /24 are not allowed to reach router Flash.

Topology:

IP Fragment Filtering

Video Solution:

You need to register to download the GNS3 Topology File. (Registration is Free!)

Related Articles: MPLS Label Filtering
Distribute List Filtering
Prefix List Filtering
RIP Filtering
VACL (VLAN Access List)

Only registered users can write comments!

Comments (1)

arbor
2013-02-28 17:17:57

I achieved fragmentation by sending ICMP packets with large Datagrams.

R1#ping
Protocol [ip]:
Target IP address: 3.3.3.3
Repeat count [5]:
Datagram size [100]: 15000
Timeout in seconds [2]:
Extended commands [n]:
Sweep range of sizes [n]:
Type escape sequence to abort.
Sending 5, 15000-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

R2#sh ip access-lists
Extended IP access list 100
10 deny ip any any fragments (122 matches)
20 permit ip any any (39 matches)

Master CCNA

Master CCNP SWITCH

Master CCNP ROUTE

Master CCNP TSHOOT

IP Fragment Filtering

Scenario:

Goal:

Topology:

Video Solution:

Comments (1)