topic Re: OSPF LSA Threshold: Security Finding in General Topics

OSPF LSA Threshold: Security Finding

NetWright — Wed, 01 Mar 2017 21:52:18 GMT

Wondering if there's a way to configure a threshold for OSPF LSA updates/messages?
Or if such a threshold is already in place by default on Palo Alto firewalls.

Something that can maybe drop anything more than say 7 LSA messages in 5 minutes.
Apparently, there's a security threat related to a device getting DOS'd by an overwhelming flow of LSA messages and our security consultant wants us to configure a threshold to drop more than x number of LSA messages in a given period.

I see there's an LSA interval like this:

•	LSA Interval (sec)—The option specifies the minimum time between transmissions of two instances of the same LSA (same router, same type, same LSA ID). This is equivalent to MinLSInterval in RFC 2328. Lower values can be used to reduce re-convergence times when topology changes occur.

Yet that doesn't seem to address the issue of an overwhelming number of updates being sent maliciously.

For comparison on the Cisco-side there's a concept of:

"OSPF Link-State Database Overload Protection"
which is configured with this command in the OSPF router process:
max-lsa maximum-number [threshold-percentage] [warning-only] [ignore-time minutes] [ignore-count count-number] [reset-time minutes]

Re: OSPF LSA Threshold: Security Finding

pulukas — Sun, 19 Mar 2017 16:22:29 GMT

No, these parameters are not available in PanOS. You could contact your sales engineer to see if there is an existing FR (Feature Request) on file for this and have them add a vote or create one. If it is new tell them it is covered under RFC 5286 for implementation.

But remember that Palo Alto is a security company here that also does routing. So the pace of feature implementation on the routing side can be on the slow side.

Re: OSPF LSA Threshold: Security Finding

NetWright — Fri, 26 May 2017 19:50:45 GMT

Got the same reply in the notes of a case opened with PAN support. They must have been looking over your shoulder. Sent email to our SE and will follow up with same.