Cisco Traffic Anomaly Detectors and Cisco Guard DDoS Mitigation Appliances
The Cisco traffic anomaly detectors and DDoS mitigation appliances provide a new approach that not only detects increasingly complex and unrepresentative denial of service attacks but also mitigates their effect to ensure business continuity and resource availability. The Cisco DDos solution has two distinct appliances:
• Cisco Traffic Anomaly Detector (TAD) XT
This solution is also available in the form of two individual modules for the Catalyst 6500 series switches and the Cisco 7600 Internet routers:
• Catalyst 6500/Cisco 7600 Router Anomaly Guard Module
• Catalyst 6500/Cisco 7600 Router Traffic Anomaly Detector Module
The detectors (whether the appliances or the modules) are designed to promiscuously monitor network traffic while looking for any variation from what is "normal," which may indicate a DDoS attack or a worm outbreak. The Cisco TAD XT alerts the Cisco Guard XT when it detects an anomaly by providing detailed reports and specific alerts.
This solution uses a Multiverification Process (MVP) architecture integrating different verification, analysis, and enforcement techniques. The MVP has five components:
• Static and dynamic DDoS filters
• Active verification (anti-spoofing) implementing source-authentication mechanisms that help ensure proper identification of legitimate traffic
• Anomaly recognition
• Protocol analysis designed to identify Layer 7 attacks, such as HTTP error attacks
• Rate limiting that prevents flows from overwhelming the target while more detailed monitoring is taking place
Figure 3-11 illustrates how the Cisco TAD XT and the Cisco Guard XT work.
Figure 3-11 Cisco TAD XT Detects an Anomaly and Updates the Guard XT
Figure 3-11 Cisco TAD XT Detects an Anomaly and Updates the Guard XT
2. Detected!
Cisco Traffic Anomaly Detector
Cisco Traffic Anomaly Detector
Protected Zone 1: Web Servers
Protected Zone 1: Web Servers
2. Detected!
1. Detected!
Protected Zone 2: Email Servers
In Figure 3-11, two zones are protected by the Cisco TAD XT: a web server farm and an email server farm. The Cisco Guard is placed at the Internet edge, and the Cisco TAD XT resides a couple of hops in the inside of the corporate network. The following are the steps illustrated in Figure 3-11.
Step 1 An attacker starts a DDoS from the Internet, and the Cisco TAD XT detects the anomaly (spike of traffic).
Step 2 The Cisco TAD XT updates the Cisco Guard XT. The Cisco Guard XT can be triggered in several ways:
— Through direct use of the web-based device manager
— Through automatic use of the "protect by packet" feature (illustrated in this example)
Step 3 After the Cisco Guard XT is activated, the Cisco Guard XT performs additional screening, and then the traffic destined to the zone under attack is diverted to the Cisco Guard XT in any of the following ways:
— The Cisco Guard XT can issue a BGP route update telling the router to divert the traffic to the Cisco Guard TX.
— If you are using the Catalyst 6500/7600 modules, the Route Health Injection (RHI) feature can trigger the packet diversion.
— A route is injected externally into the network.
Step 4 The attack traffic is redirected to the Cisco Guard XT, and legitimate traffic is allowed to the protected zone, as illustrated in Figure 3-12.
Figure 3-12 Attack Traffic Redirected
Figure 3-12 Attack Traffic Redirected
- Cisco Traffic Anomaly Detector
The Cisco Guard can also be deployed with other anomaly detection systems. Examples of this include Arbor's Peakflow SP and Peakflow X. Arbor's Peakflow SP is designed for service providers, and Peakflow X is designed for enterprises. Typically, enterprises deploy the Cisco Guard XT at their Internet edge, or they co-locate it at their Internet service provider network to avoid the unnecessary traffic consuming their bandwidth. Because of this, numerous service providers offer managed network DDoS protection, hosting DDoS protection, peering point DDoS protection, and infrastructure protection services. This is based on a solution that Cisco makes available to service providers called "clean pipes."
NOTE For more information about clean pipes, go to http://www.cisco.com/go/cleanpipes.
Figure 3-13 illustrates the protection cycle that the Cisco Guard XT follows to analyze, filter, and rate-limit the traffic.
Figure 3-13 Cisco Guard XT Protection Cycle
Control Feedback
Figure 3-13 Cisco Guard XT Protection Cycle
When the traffic is redirected to the Cisco Guard XT, it first filters the traffic using several filtering techniques. If the Cisco Guard XT determines that the packets are malicious, it drops them at this stage. If the packets are not malicious, the packets are sent to different protection levels using several types of authentication methods. Subsequently, the Cisco Guard XT analyzes the traffic flow, drops the traffic that exceeds the defined rate that the zone can handle, and then injects the legitimate traffic back to the zone. A closed-loop feedback cycle dynamically adjusts its protection policies.
NOTE For more detailed information on how to configure the Cisco Guard XT and the Cisco TAD XT, go to http://www.cisco.com/en/US/products/ps5888/ products_installation_and_configuration_guides_list.html.
Continue reading here: The Importance of Signatures Updates
Was this article helpful?