Fixing DOS Attack Policy in Service VPN
Short answer
D "Echo" must be matched rather than icmp-msg in protocol 1 to effectively block the incoming DoS attack packets.
Question
Refer to the exhibit. The policy has failed to stop DOS attacks from within the service VPN 100. The counter shows no logб but the destination network reported DOS attacks from network 10.10.0.0/16. The engineer identified a misconfigured policy. Which setting is the source of the issue?
Key Takeaways
The core trap is confusing ICMP Echo Request with Echo Reply; effective DoS mitigation for ping floods requires blocking the 'Echo' request, not the reply or generic messages.
This question examines the correct configuration of IPsec service policies to mitigate Denial of Service (DoS) attacks within a Cisco SD-WAN environment, specifically focusing on ICMP protocol matching.
Common mistake: Engineers often select 'Echo-reply' or generic 'icmp-msg', failing to recognize that DoS attacks typically involve unsolicited Echo Requests from the source network.
Expert Analysis
Why the Answer Is Correct
The policy is designed to stop DoS attacks originating from within the service VPN. The destination network reports attacks from 10.10.0.0/16, implying these hosts are sending malicious traffic. In the context of ICMP-based DoS (ping floods), the attack consists of Echo Requests sent TO the victim. Therefore, the policy must match and block 'Echo' requests. Option D correctly identifies that 'Echo' must be matched rather than 'icmp-msg' or 'Echo-reply'.
Why the Other Options Are Wrong
Option A suggests matching 'Echo-reply'; this would allow incoming Echo Requests while blocking replies, which does not stop the DoS flood targeting the network. Option B suggests changing direction to 'from-tunnel'; however, the threat is internal ('within the service VPN'), so 'from-service' is the appropriate direction to filter traffic originating from local endpoints before it exits. Option C suggests blocking all Protocol 1 options; while broad, it lacks the precision required for troubleshooting a specific misconfiguration and might block legitimate ICMP traffic needed for diagnostics.
Community Comment Notes
Community consensus strongly supports Option D. As user Helloory noted, the correct answer is 'Echo', emphasizing that the policy needs to catch the initial attack packet (the request) rather than the response.
Exam Strategy
When analyzing security policies for DoS, always identify the direction of the attack. If the source is internal and the target is external or another internal segment, ensure your policy matches the inbound request type (e.g., Echo Request) rather than the outbound response.
Frequently Asked Questions
Why is 'from-service' the correct direction?
What is the difference between Echo and Echo-reply?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Helloory 👍 1 Answered DCorrect Answer is Echo
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.