MPLS VPN Security

146 Chapter 5: Security Recommendations

rACLS and Fragmented Packets

ACLs have a fragments keyword that enables specialized fragmented packet-handling

behavior. In general, noninitial fragments that match the L3 statements (irrespective of the

L4 information) in an ACL are affected by the permit or deny statement of the matched

entry. Note that the use of the fragments keyword can force ACLs to either deny or

permit noninitial fragments with more granularity.

In the rACL context, filtering fragments adds an additional layer of protection against a

DoS attack that uses only noninitial fragments (such as FO > 0). Using a deny statement

for noninitial ...