Unable to exclude Fragmented packet type DOS signature from inspection using a Firewall Stateless Ignore Policy

Technical Articles ID: KB94348
Last Modified: 2023-01-20 10:29:28 Etc/GMT

Environment

Trellix Intrusion Prevention System

Problem 1

You see many Inbound IP Fragment Volume Too High / Outbound IP Fragment Volume Too High IP Fragment Volume Too High signature alerts.

The alerts are shown in Attack logs after you apply a Firewall Policy with the Stateless Ignore Action.

The applied Stateless ignore action means that the firewall rule ignores the traffic from inspection between the client and server. No alerts are expected to appear in the attack logs.

Problem 2

You want to ignore or exclude the Inbound IP Fragment Volume Too High / Outbound IP Fragment Volume Too High IP Fragment Volume Too High signature from inspection using the firewall policy. You also create a bidirectional Firewall Stateless ignore policy between the hosts. After you apply the policy, you still see alerts of this signature in the Attack log.

Solution

This outcome is expected behavior.

During initial L3 processing, reassembly is performed. Post reassembly, a DOS check is applied for these reassembled packets. The check is to avoid tear-drop DOS attacks.
It's performed before ACL or Firewall Rule processing for fragmented traffic. So, the Firewall Policy rule can't exclude this particular signature from inspection because it's related to fragmented packets. For other DOS attacks, the Stateless ignore Firewall Policy works as expected.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Unable to exclude Fragmented packet type DOS signature from inspection using a Firewall Stateless Ignore Policy

Environment

Problem 1

Problem 2

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Unable to exclude Fragmented packet type DOS signature from inspection using a Firewall Stateless Ignore Policy

Environment

Problem 1

Problem 2

Solution

Affected Products

Languages:

Choose your region

Title

Title