Check: AADC-AG-000156
A10 Networks ADC ALG STIG:
AADC-AG-000156
(in versions v2 r1 through v1 r1)
Title
The A10 Networks ADC must protect against TCP SYN floods by using TCP SYN Cookies. (Cat II impact)
Discussion
A SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target in an attempt to consume resources, making the device unresponsive to legitimate traffic. TCP SYN Cookies are commonly implemented by the Operating System on endpoints, but are also often implemented on network devices. A10 Networks ADCs provide protection against TCP SYN flood attacks by using SYN cookies. SYN cookies enable the device to continue to serve legitimate clients during a TCP SYN flood attack without allowing illegitimate traffic to consume system resources.
Check Content
Review the device configuration. The following command displays the device configuration and filters the output on the string "syn-cookie": show run | inc syn-cookie If SYN cookies are not enabled, this is a finding.
Fix Text
The following command enables hardware-based SYN cookies: syn-cookie on-threshold [num] off-threshold [num] Note: Hardware-based SYN cookies are available only on some models. If the "on-threshold" and "off-threshold" options are omitted, SYN cookies are enabled and are always on regardless of the number of half-open TCP connections.
Additional Identifiers
Rule ID: SV-237063r639636_rule
Vulnerability ID: V-237063
Group Title: SRG-NET-000512-ALG-000062
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000366 |
The organization implements the security configuration settings. |
Controls
Number | Title |
---|---|
CM-6 |
Configuration Settings |