topic fwaccel6 dos rate command - IPv6 in Firewall and Security Management

fwaccel6 dos rate command - IPv6

Chris_75 — Tue, 13 Feb 2024 10:07:40 GMT

Hello,

In order to protect ourself from DOS traffic towards our DNS servers, we try to install command similar to the following on our checkpoint security gateway.

Security gateway cluster, R81.20.

fwaccel6 dos rate add -l a -a d -n "DNSintProtectRateIPv6" destination range:xyz1:620:40z:2:0:0:0:110-xyz1:620:40z:2:0:0:0:111 service 17/53 new-conn-rate 250 track source
ERROR: address is too long
ERROR: invalid begin
ERROR: Bad destination 'range:xyz1:620:40z:2:0:0:0:110-xyz1:620:40z:2:0:0:0:111'

We tried with various IPv6 notation, short notation, fully expanded notation, same result.

We tried also with the destination as cidr, with or without mask, same result.

In the documentation and in the forum we could not find examples with the correct notation.

Can we use this command for IPv6? Do you have anexample of a correct syntax for the IPv6 address?

Thanks for you

Christophe

Re: fwaccel6 dos rate command - IPv6

_Val_ — Tue, 13 Feb 2024 10:58:25 GMT

It is supposed to be a single IP for destination, not range. Please try adding two IP addresses consecutively with two different commands

Re: fwaccel6 dos rate command - IPv6

Chris_75 — Tue, 13 Feb 2024 14:40:58 GMT

Hi, thx for the suggestion.

Seems to behave in the same way, see below:

ngf01:mplane> fwaccel6 dos rate add -l a -a d destination range:xyz1:620:40z:2:0:0:0:110 service 17/53 new-conn-rate 250 track source
ERROR: address is too long
ERROR: invalid begin
ERROR: Bad destination 'range:xyz1:620:40z:2:0:0:0:110'
ngf01:mplane> fwaccel6 dos rate add -l a -a d destination range:xyz1:620:40z:2::110 service 17/53 new-conn-rate 250 track source
ERROR: address is too long
ERROR: invalid begin
ERROR: Bad destination 'range:xyz1:620:40z:2::110'
ngf01:mplane> fwaccel6 dos rate add -l a -a d destination cidr:xyz1:620:40z:2::110 service 17/53 new-conn-rate 250 track source
ERROR: address is too long
ERROR: invalid net
ERROR: Bad destination 'cidr:xyz1:620:40z:2::110'
ngf01:mplane>

Re: fwaccel6 dos rate command - IPv6

_Val_ — Wed, 14 Feb 2024 10:46:11 GMT

Should be "fwaccel6 dos rate add -l a -a d destination xyz1:620:40z:2:0:0:0:110 service 17/53 new-conn-rate 250 track source"

Please stick to the documented syntax.

Re: fwaccel6 dos rate command - IPv6

Chris_75 — Wed, 28 Feb 2024 10:19:16 GMT

I could open a ticket, it looks like we need to put bracket for the ipv6 address, like:

Clish> fwaccel6 dos rate add -a d -l a destination range:[1:620:40:2:0:0:0:110]-[1:620:40:2:0:0:0:111] service 17/53 new-conn-rate 250 track source

It worked for me.

Thx