Description

This KB article outlines effective protection strategies to mitigate the risks associated with first fragment UDP attacks on the SRX Series. It presents a comprehensive overview of various security features and configurations that can be implemented or considered to bolster the defense against such malicious activities. By following the guidelines outlined in this document, network administrators can fortify their systems and ensure a robust security posture against these specific types of threats.

Symptoms

  • Presence of an UDP fragment attack targeting multiple source addresses, indicative of a potential Distributed Denial of Service (DDoS) attempt.
  • Detection of inbound traffic directed towards closed ports on the intended target, suggesting an active exploitation or vulnerability probing.
  • Observance of packets containing first fragments exclusively, highlighting an attempt to bypass security measures using fragmented UDP packets.

Solution

  • Consider implementing Screens configurations, carefully set to protect specifically against the identified UDP attack while ensuring normal traffic is not affected. Configuring specific thresholds can help in effectively filtering and mitigating potential threats.
  • Implement robust firewall filters that include carefully crafted configuration statements to filter out any suspicious or unwanted traffic. These filters should be designed to efficiently manage and control the flow of traffic within the network, enhancing overall security.
  • Integrate IPS configurations into your SRX setup to actively monitor and prevent potential security breaches. This additional layer of protection can aid in the timely detection and mitigation of any malicious activities or intrusion attempts on your network. Be sure to evaluate and customize these options to best suit your network's security requirements.

Modification History

2023-10-30 : Article Created

Related Information