Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

close

keyboard_arrow_left

Table of Contents Expand all

play_arrow Overview
play_arrow Configuring Administrative Credentials and Privileges
- Understanding the Associated Password Rules for an Authorized Administrator
- Configuring a Common Criteria Authorized Administrator
play_arrow Configuring Network Time Protocol
- Configuring Network Time Protocol
play_arrow Configuring Roles and Authentication Methods
play_arrow Configuring SSH and Console Connection
play_arrow Configuring the Remote Syslog Server
- Sample Syslog Server Configuration on a Linux System
play_arrow Configuring Audit Log Options
- Configuring Audit Log Options in the Evaluated Configuration
- Sample Code Audits of Configuration Changes
play_arrow Configuring Event Logging
play_arrow Configuring VPNs
- Configuring VPN on a Device Running Junos OS
play_arrow Configuring Security Flow Policies
- Understanding a Security Flow Policy on a Device Running Junos OS
play_arrow Configuring Traffic Filtering Rules
play_arrow Configuring Network Attacks
play_arrow Configuring the IDP Extended Package
- IDP Extended Package Configuration Overview
play_arrow Configuring Cluster Mode
play_arrow Performing Self-Tests on a Device
- Understanding FIPS Self-Tests
play_arrow Configuration Statements
play_arrow Junos-FIPS Configuration Restrictions

list Table of Contents

English

keyboard_arrow_right

Configuring Mandatory Reject Rules for Invalid Fragments and Fragmented IP Packets

date_range 13-Dec-23

arrow_backward

arrow_forward

This topic describes how to configure mandatory reject rules for invalid fragments and fragmented IP packets that cannot be reassembled.

Before you begin, log in with your root account on a Junos OS device running Junos OS Release 22.2R2 and edit the configuration.

Note:

You can enter the configuration commands in any order and commit all the commands at once.

To configure mandatory reject rules:

Specify the flow configuration to forcefully reassemble the IP fragments.
```
[edit]
user@host# set security flow force-ip-reassembly
```
Delete the screen ID and the IDS options and enable the ICMP fragment IDS option.
```
[edit]
user@host# delete security screen ids-option trustScreen icmp fragment
```
Delete the IP layer IDS option and enable the IP fragment blocking IDS option.
```
[edit]
user@host# delete security screen ids-option trustScreen ip block-frag
```

arrow_backward PREVIOUS Logging the Dropped Packets Using Default Deny-all Option

NEXT arrow_forward Configuring Default Reject Rules for Source Address Spoofing

footer-navigation