Subject: [BEHAVE] IP Fragmentation and Firewalls

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 12 Oct 2011 20:53:46 +0300

Hi all 

maybe someone in this group can help me with some literature references. 

I am looking for measurements of how firewalls treat fragmented IP packets. 

I noticed that there are lots of papers on how middleboxes impact transport layer protocols but I fail to find recent studies about the impact on the network layer (in particular with regard to IP fragmentation). 

Ciao
Hannes

---

From: "Dan Wing" <[email-masked]>
Date: Wed, 12 Oct 2011 15:12:33 -0700

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Hannes Tschofenig
> Sent: Wednesday, October 12, 2011 10:54 AM
> To: [email-masked]
> Subject: [BEHAVE] IP Fragmentation and Firewalls
> 
> Hi all
> 

Some simply drop fragments.  Some forward fragments, without looking at them
at all, under the assumption that the packet with the header was/will be
forwarded (or dropped) appropriately by the firewall and the fragmented
packet will cause no harm to the host.  Others reassemble the packet.
Others only reassemble the packet if the fragments arrived in order.  I
believe that covers everything that can happen.  I know that some of Cisco's
firewall will vary their behavior (in those above categories) based on their
hardware and software versions, if they are doing higher-level protocol
inspection, and so on.

> I noticed that there are lots of papers on how middleboxes impact
> transport layer protocols but I fail to find recent studies about the
> impact on the network layer (in particular with regard to IP
> fragmentation).

"It depends."

M'self, I would give up on IPv4 and worry about how to get this working like
we want with IPv6.

-d

> Ciao
> Hannes
> 
> _______________________________________________
> Behave mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/behave

---

From: Mark Andrews <[email-masked]>
Date: Thu, 13 Oct 2011 13:47:31 +1100

> M'self, I would give up on IPv4 and worry about how to get this working like

Fragmentation happens in IPv6 as well.  Anything doing DNSSEC will
receive/generate fragmented UDP.  IPv4 and IPv6.  Lots of corporate
firewalls have been fixed to pass fragemented IP in the last couple
of years as DNSSEC has been rolled out.

If you want to test whether the path between your recursive server
and the rest of the world actually supports the recommended EDNS
packet sizes try the following lookups.

	dig edns-v6-ok.isc.org TXT
	dig edns-v4-ok.isc.org TXT

The servers are specially configured to only use UDP and the response
is sized to return a 4096 octet DNS message.  Your recursive server
will add a few extra bytes.

If you want to test the firewall directly use the following queries
which simular a modern recursive server.

	dig edns-v6-ok.isc.org TXT +dnssec +norec @edns-v6-ok.isc.org
	dig edns-v4-ok.isc.org TXT +dnssec +norec @edns-v4-ok.isc.org

Mark

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Mikael Abrahamsson <[email-masked]>
Date: Thu, 13 Oct 2011 07:52:23 +0200 (CEST)

> I am looking for measurements of how firewalls treat fragmented IP 

Not specifically a firewall but instead a router, but this might be of 
interest. A Cisco 7600 with PFC3B and earler, will by default punt all 
IPv6 packets with fragmentation header to RP, meaning the aggregate 
forwarding performance is going to be a lot lower than if this is just 
handled in fast-path. There are a *lot* of these routers out there.

There is a command to fast-path either forward (bypassing ACLs) or drop 
these packets.

We ran into this problem, a lot of the 6to4/Teredo traffic seems to have 
fragmentation headers (don't know which, this was the router connecting 
our Teredo relay, and a majority of the traffic seen there is Teredo <-> 
6to4 traffic.

PFC3C fixes this, btw.

-- 
Mikael Abrahamsson    email: [email-masked]

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 13 Oct 2011 10:31:46 +0300

Hi Mikael, 

yes, a regular router (or a NAT) is also of interest (not only a firewall). Particularly, the home Internet gateway environment is an area where I believe there could be lots of problems. 

I know that firewalls can easily be configured to drop these packets and I could imagine that many admins enable it. 
However, I would like to have some measurement data. 

Ciao
Hannes
 
On Oct 13, 2011, at 8:52 AM, Mikael Abrahamsson wrote:

> Not specifically a firewall but instead a router, but this might be of interest. A Cisco 7600 with PFC3B and earler, will by default punt all IPv6 packets with fragmentation header to RP, meaning the aggregate forwarding performance is going to be a lot lower than if this is just handled in fast-path. There are a *lot* of these routers out there.
> 
> There is a command to fast-path either forward (bypassing ACLs) or drop these packets.
> 
> We ran into this problem, a lot of the 6to4/Teredo traffic seems to have fragmentation headers (don't know which, this was the router connecting our Teredo relay, and a majority of the traffic seen there is Teredo <-> 6to4 traffic.
> 
> PFC3C fixes this, btw.
> 
> --

---

From: Mikael Abrahamsson <[email-masked]>
Date: Thu, 13 Oct 2011 10:25:54 +0200 (CEST)

On Thu, 13 Oct 2011, Hannes Tschofenig wrote:

> yes, a regular router (or a NAT) is also of interest (not only a 
> firewall). Particularly, the home Internet gateway environment is an 
> area where I believe there could be lots of problems.

Oki, just to be clear for everybody, Cisco 7600 is a L3 switch(/router) 
with 40 gigabit/s per slot capacity, a lot of people use it for 
core/aggregation purposes.