[ Contents] [ Prev] [ Next] [ Index] [ Report an Error]

Detecting and Blocking IP Packets with Incorrectly Formatted Options

Attackers sometimes configure IP options incorrectly, producing either incomplete or malformed fields. The incorrect formatting is anomalous and potentially harmful to the intended recipient.

Before You Begin
For background information, read Understanding Bad IP Option Protection.

You can use either J-Web or the CLI configuration editor to detect and block IP packets with incorrectly formatted IP options. The specified security zone is the one from which the packets originated.

This topic covers:

J-Web Configuration

To configure screens:

Select Configure>CLI Tools>Point and Click CLI.
Next to Security, click Configure or Edit.
Next to Screen, click Configure.
Next to Ids option, click Add new entry.
In the Name box, type zone.
Next to Ip, click Configure.
Next to Bad option, select the check box and click OK.
To save and commit the configuration, click Commit.

To configure zones:

Select Configure>CLI Tools>Point and Click CLI.
Next to Security, click Configure or Edit.
Next to Zones, click Configure.
Next to Security zone, click Add new entry.
In the Name box, type zone.
In the Screen box, type ip-bad-option and click OK.
To save and commit the configuration, click Commit.

CLI Configuration


            
               user@host# set security screen ids-option
                     ip-bad-option ip bad-option
               user@host# set security zones security-zone
                     zone screen ip-bad-option

Detecting and Blocking IP Packets with Incorrectly Formatted Options

J-Web Configuration

CLI Configuration

Related Topics