The Nokia layer 2 switch must manage excess bandwidth to limit the effects of packet flooding types of denial-of-service (DoS) attacks.

DoS is a condition when a resource is not available for legitimate users. Packet flooding distributed denial-of-service (DDoS) attacks are referred to as volumetric attacks and have the objective of overloading a network or circuit to deny or seriously degrade performance. This denies access to the services that normally traverse the network or circuit. Volumetric attacks have become relatively easy to launch by using readily available tools such as Low Orbit Ion Cannon or by using botnets. Measures must be taken to mitigate the effects of a successful volumetric attack to ensure sufficient capacity is available for mission-critical traffic. Managing capacity may include, for example, establishing selected network usage priorities or quotas and enforcing them using rate limiting, Quality of Service (QoS), or other resource reservation control methods. These measures may also mitigate the effects of sudden decreases in network capacity that are the result of accidental or intentional physical damage to telecommunications facilities (such as cable cuts or weather-related outages).

Review the Nokia router configuration to verify QoS has been enabled to ensure sufficient capacity is available for mission-critical traffic such as voice and enforce the traffic priorities specified by the Combatant Commands/Services/Agencies (CC/S/As). Nokia routers have default QoS policy "1" applied to all ports and service access points (SAPs). Based on the network requirements, another QoS policy should be defined and applied to all ports. Use the commands below to verify the QoS policies defined and where the policies are applied: For sap-ingress policies: - show qos sap-ingress association Associations Service-Name : 10 Service-Id : 10 (VPLS) Customer-Id : 1 - SAP : 1/1/c3/10 For sap-egress policies: - show qos sap-egress association Associations Service-Name : 900 Service-Id : 900 (VPLS) Customer-Id : 1 - SAP : lag-4:900 For network policies: - queue <queue id> - show qos network <policy id> detail Interface Association Interface : to-sr-1-24d-a IP Addr. : 192.168.1.2/30 Port Id : 1/1/c9/1 IPv6 Addr. : 2001:400:0:3::2/64 Interface : to-sr-1-24d-b IP Addr. : 192.168.2.1/30 Port Id : 1/1/c10/1 - show qos network-queue association Port-id : 1/1/c3/1 Port-id : 1/1/c3/2 Port-id : 1/1/c3/3 Port-id : 1/1/c3/4 If the switch is not configured to implement a QoS policy, this is a finding.

Implement a QoS policy for traffic prioritization and bandwidth reservation. This policy must enforce the traffic priorities specified by the CC/S/As. Following is one of multiple ways to create a QoS policy. Configure sap-ingress and/or sap-egress QoS policies: - configure qos sap-ingress <id> create - configure qos sap-egress <id> create For each sap-ingress and sap-egress QoS policy, create as many policers as needed: - policer <policer id> create - percent-rate <value> cir <value> - mbs <value in kbytes> - cbs <value in kbytes> - back Create as many forwarding classes as needed. Forwarding classes can be created using ip-criteria, Differentiated Services Code Point (DSCP) bits in IP header, Precedence bits (IP header), and dot1p bits (Ethernet header). Because this is a layer 2 switch requirement, the example below is using dot1p bits: - fc <forwarding class> create - policer <policer id> - back - dot1p <dot1p value> fc <forwarding class> priority {low or high} - exit For network policy, copy the default network policy 1 into a new network policy and modify parameters as needed: - configure qos copy network 1 <network policy id> To list the entries in the network policy created: - configure qos network <network policy id> - info detail Modify the parameters as needed, or use the "no" form of the command to remove them from the configuration. Configure network QoS queues: - configure qos network-queue <network queue id> create - queue <queue id> <queue type> create - rate <pir percent> cir <cir percent> fir <fir percent> - mbs <percentage> - cbs <percentage> Configure as many queues as needed. Create as many forwarding classes as needed and assign a queue to them: - fc <name of forwarding class> create - multicast-queue <queue id> - queue <queue id> QoS policies are applied at the ingress or egress of the access and network ports. For access interfaces: - configure service <service id> sap <sap id> ingress qos <sap ingress qos policy id> - configure service <service id> sap <sap id> egress qos <sap egress qos policy id> For network interfaces: - configure router interface <interface name> qos <network qos policy id>