Fixing DOS Attack Policy in Service VPN
Refer to the exhibit. The policy has failed to stop DOS attacks from within the service VPN 100. The counter shows no logб but the destination network reported DOS attacks from network 10.10.0.0/16. The engineer identified a misconfigured policy. Which setting is the source of the issue?
Community Insight
The core trap is confusing ICMP Echo Request with Echo Reply; effective DoS mitigation for ping floods requires blocking the 'Echo' request, not the reply or generic messages.
This question examines the correct configuration of IPsec service policies to mitigate Denial of Service (DoS) attacks within a Cisco SD-WAN environment, specifically focusing on ICMP protocol matching.
Engineers often select 'Echo-reply' or generic 'icmp-msg', failing to recognize that DoS attacks typically involve unsolicited Echo Requests from the source network.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The policy is designed to stop DoS attacks originating from within the service VPN. The destination network reports attacks from 10.10.0.0/16, implying these hosts are sending malicious traffic. In the context of ICMP-based DoS (ping floods), the attack consists of Echo Requests sent TO the victim. Therefore, the policy must match and block 'Echo' requests. Option D correctly identifies that 'Echo' must be matched rather than 'icmp-msg' or 'Echo-reply'.Why the Other Options Are Wrong
Option A suggests matching 'Echo-reply'; this would allow incoming Echo Requests while blocking replies, which does not stop the DoS flood targeting the network. Option B suggests changing direction to 'from-tunnel'; however, the threat is internal ('within the service VPN'), so 'from-service' is the appropriate direction to filter traffic originating from local endpoints before it exits. Option C suggests blocking all Protocol 1 options; while broad, it lacks the precision required for troubleshooting a specific misconfiguration and might block legitimate ICMP traffic needed for diagnostics.Community Comment Notes
Community consensus strongly supports Option D. As user Helloory noted, the correct answer is 'Echo', emphasizing that the policy needs to catch the initial attack packet (the request) rather than the response.Exam Strategy
When analyzing security policies for DoS, always identify the direction of the attack. If the source is internal and the target is external or another internal segment, ensure your policy matches the inbound request type (e.g., Echo Request) rather than the outbound response.
Frequently Asked Questions
Why is 'from-service' the correct direction?
Because the DoS attacks originate from within the service VPN (internal sources), the policy must inspect traffic coming from the service interface.
What is the difference between Echo and Echo-reply?
Echo refers to the Request packet initiating the ping; Echo-reply is the Response. Blocking Echo stops the flood at the source.