The Aviat WTM must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.

DoS is a condition when a resource is not available for legitimate users. Packet flooding distributed DoS (DDoS) attacks are referred to as volumetric attacks and have the objective of overloading a network or circuit to deny or seriously degrade performance, which denies access to the services that normally traverse the network or circuit. Volumetric attacks have become relatively easy to launch by using readily available tools such as Low Orbit Ion Cannon or by using botnets.

Measures to mitigate the effects of a successful volumetric attack must be taken to ensure that sufficient capacity is available for mission-critical traffic. Managing capacity may include, for example, establishing selected network usage priorities or quotas and enforcing them using rate limiting, Quality of Service (QoS), or other resource reservation control methods. These measures may also mitigate the effects of sudden decreases in network capacity that are the result of accidental or intentional physical damage to telecommunications facilities (such as cable cuts or weather-related outages).

Satisfies: SRG-NET-000193-L2S-000020, SRG-NET-000057-L2S-000005, SRG-NET-000520-L2S-000105

Verify the Aviat WTM has the default DSCP decode policy configured with required priority mappings and applied to all required interfaces with the following steps:

1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> Quality of Service >> Encoding/Decoding >> DSCP. 3. Locate the "default" row and verify "Exists" is selected for each required DSCP value with the correct priority and color mappings in accordance with DoW traffic prioritization requirements. 4. Navigate to Switching and Routing >> Quality of Service >> Interfaces. 5. Verify each required interface has the "default" DSCP decode policy assigned in the DSCP Decode Policy column.

If the default DSCP decode policy does not have required priority mappings configured in accordance with site security and configuration plan, or if it is not assigned to all required interfaces, this is a finding.

Configure the Aviat WTM default DSCP decode policy with required priority mappings and apply it to all required interfaces with the following steps:

1. Log on to the Web UI using an admin account. 2. Using the Web UI, navigate to Switching and Routing >> Quality of Service >> Encoding/Decoding >> DSCP. 3. Select the "default" row to edit it. 4. For each DSCP value (0-63), select "Exists" and set the priority and color in accordance with DoW traffic prioritization requirements. Scroll down to ensure all values are configured in accordance with site security and configuration plan. 5. Click "Commit". 6. Navigate to Switching and Routing >> Quality of Service >> Interfaces. 7. For each required interface, select "default" from the DSCP Decode Policy drop-down and select "default" from the DSCP Encode Policy drop-down. 8. Click "Commit".