CCIE Security Practice Labs

Section 10.0: Security Violations

10.1. DoS Attack

1. Configure policy routing on R3 to black-hole ICMP echo packets destined for R2:

   hostname r3
   !
   ip local policy route-map null
   !
   access-list 110 deny   icmp host 179.7.2.3 host 179.7.2.2 echo-reply
   access-list 110 permit icmp host 179.7.2.3 host 179.7.2.2
   route-map null permit 10
    match ip address 110
    set interface Null0
   

2. Apply the policy in global mode, as packets originated in R3 hit the local policy map.

3. Verify ping from R3 to R2 and vice versa:

   ! Ping from R2 to R3 Fails.
   r3#ping 179.7.2.2
   
   Type escape sequence to abort.
   Sending 5, 100-byte ICMP Echos to 179.7.2.2, timeout is 2 seconds:
   .....
   Success rate is 0 percent (0/5)
   r3#
   
   ! Ping from R2 to R3 Success.
   r2#ping 179.7.2.3 Type escape sequence ...