← Back to A10 Networks ADC ALG Security Technical Implementation Guide

V-237063

CAT II (Medium)

The A10 Networks ADC must protect against TCP SYN floods by using TCP SYN Cookies.

Rule ID

SV-237063r639636_rule

STIG

A10 Networks ADC ALG Security Technical Implementation Guide

Version

V2R2

CCIs

CCI-000366

Discussion

A SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target in an attempt to consume resources, making the device unresponsive to legitimate traffic. TCP SYN Cookies are commonly implemented by the Operating System on endpoints, but are also often implemented on network devices. A10 Networks ADCs provide protection against TCP SYN flood attacks by using SYN cookies. SYN cookies enable the device to continue to serve legitimate clients during a TCP SYN flood attack without allowing illegitimate traffic to consume system resources.

Check Content

Review the device configuration.

The following command displays the device configuration and filters the output on the string "syn-cookie":

show run | inc syn-cookie

If SYN cookies are not enabled, this is a finding.

Fix Text

The following command enables hardware-based SYN cookies:
syn-cookie on-threshold [num] off-threshold [num]

Note: Hardware-based SYN cookies are available only on some models. If the "on-threshold" and "off-threshold" options are omitted, SYN cookies are enabled and are always on regardless of the number of half-open TCP connections.