6.3 Default Threat Protection & Packet Handling

6.3 Default Threat Protection & Packet Handling

Quick Answer: Fireware's Default Packet Handling operates at the ingress kernel network layer before firewall policies are evaluated, filtering out low-level attacks to protect firewall CPU and memory. It includes Blocked Ports (instantly dropping traffic on high-risk ports), Attack Detection (detecting port scans, IP address sweeps, and SYN attacks), and Auto-Block Attacking Sites (temporarily blacklisting offending IPs for a default of 20 minutes). It also provides DoS / Flood Protections (SYN, ICMP, and UDP rate thresholds) and IP Spoofing Protection (verifying that source IPs match the ingress interface's routing table). Administrators manage these blocks via the Blocked Sites tab in Firebox System Manager (FSM).

---

Architecture of Default Packet Handling

In modern network defense, enterprise firewalls are continuously bombarded by automated port scanners, botnet probes, denial-of-service floods, and malformed packets. If a firewall were forced to allocate a state table entry, evaluate hundreds of policy objects, and parse proxy headers for every unsolicited malicious packet, its CPU and RAM would be exhausted rapidly.

To prevent resource exhaustion, Fireware OS implements Default Packet Handling at the very beginning of the packet processing pipeline, operating directly within the kernel interface driver.

+-----------------------------------------------------------------------------------------+
|                           FIREWARE INGRESS PROCESSING PIPELINE                          |
+-----------------------------------------------------------------------------------------+
|  1. PHYSICAL INGRESS           : Packet arrives on network interface hardware           |
|  2. RAW KERNEL FILTERING       : Default Packet Handling & IP Spoofing Checks           |
|  3. BLOCKED SITES & PORTS      : Drops known blocked IPs and banned destination ports   |
|  4. FLOOD & DOS MITIGATION     : Evaluates SYN, UDP, and ICMP flood thresholds          |
|  5. ATTACK SIGNATURE ENGINE    : Detects Port Scans & IP Sweeps (Triggers Auto-Block)   |
|  6. FIREWALL POLICY LOOKUP     : Auto-Order or Manual Order policy evaluation           |
|  7. DEEP INSPECTION & PROXY    : Layer 7 proxies, AV, IPS, and subscription services    |
|  8. EGRESS TRANSMISSION        : Packet is routed and transmitted out egress port       |
+-----------------------------------------------------------------------------------------+

Because Default Threat Protection executes in kernel space before policy lookup, packets matching these signatures are dropped silently with virtually zero processing latency. This ensures that the firewall remains responsive even when undergoing massive distributed scanning campaigns.

---

Attack Detection and the Auto-Block Engine

Fireware continuously monitors the behavioral characteristics of traffic streams passing into and through its interfaces. When traffic exhibits malicious scanning or probing behavior, the Attack Detection engine engages defensive countermeasures.

Primary Attack Patterns Detected by Default Packet Handling

• Port Scans: Occurs when a single remote IP address rapidly transmits probes across multiple destination ports on a single protected host (e.g., sequentially probing ports 21, 22, 23, 25, 80, 443, and 3389 to map listening services).
• IP Sweeps (Address Space Probing): Occurs when a single remote IP address transmits probes to a single port across an entire range of host IP addresses within a subnet (e.g., probing port 445 on every address from 10.0.1.1 to 10.0.1.254 to locate vulnerable SMB servers).
• SYN Attacks (Half-Open TCP Floods): Occurs when an attacker floods an interface with TCP SYN packets without completing the three-way handshake (ACK), attempting to exhaust the operating system's connection backlog queue.
• Spoofed Packets: Packets bearing source IP addresses that are architecturally impossible on the interface where they arrived.
• Malformed / Illegal Packets: Packets containing invalid TCP flag combinations, such as SYN+FIN (illegal under RFC 793), Xmas-tree packets (FIN+PSH+URG flags active), or Null packets (zero flags set).

sequenceDiagram
    autonumber
    actor Attacker as Malicious Remote Host (203.0.113.88)
    participant Firebox as Firebox Kernel (Default Packet Handling)
    participant FSM as Blocked Sites Table (FSM)
    actor Target as Internal Server (10.0.1.10)
    
    Attacker->>Firebox: Probes TCP Port 21 (SYN)
    Firebox-->>Firebox: Records scan probe counter for 203.0.113.88
    Attacker->>Firebox: Probes TCP Port 22 (SYN)
    Attacker->>Firebox: Probes TCP Port 23 (SYN)
    Attacker->>Firebox: Probes TCP Port 80 (SYN)
    Firebox->>Firebox: Port scan threshold exceeded!
    Firebox->>FSM: Adds 203.0.113.88 to Blocked Sites (Timer: 20 mins)
    Firebox-->>Attacker: Drops packet silently (No state table entry)
    Attacker->>Firebox: Subsequent probe to Port 443
    Firebox-->>Attacker: Instant drop at kernel driver (Blocked Site match)
    Note over Target: Internal server never receives any probe traffic

The Auto-Block Attacking Sites Mechanism

When an attack pattern crosses configured thresholds, Fireware's Auto-Block mechanism takes immediate action:

1. Dynamic Blacklist Insertion: The Firebox extracts the attacker's source IP address and inserts it directly into the Blocked Sites list.
2. The 20-Minute Default Duration: By default, auto-blocked IP addresses remain on the Blocked Sites list for 20 minutes. During this window, all subsequent traffic originating from that source IP is dropped at the physical interface layer, regardless of destination port or policy definitions.
3. Configurability: Administrators can adjust the auto-block duration from as low as 1 minute to several hours, or disable auto-blocking entirely for specific attack types.
4. Blocked Sites Exceptions: To prevent accidental denial of service against critical external partners, WAN routers, or cloud services, administrators can configure Blocked Sites Exceptions. Any IP address, range, or subnet placed in the Exceptions list will never be auto-blocked, even if it triggers attack thresholds (e.g., an external vulnerability assessment scanner operated by the corporate security team).

---

Denial of Service (DoS) and Flood Protections

Fireware OS incorporates dedicated rate-limiting and flood-suppression engines designed to maintain appliance stability during high-volume DoS attacks.

Flood Mitigation Thresholds

Administrators configure flood thresholds within the Default Packet Handling configuration dialog:

• SYN Flood Protection: Monitors the arrival rate of TCP SYN packets. If the rate exceeds the configured threshold (measured in packets per second per destination or globally), the Firebox drops subsequent incoming SYN packets until the arrival rate normalizes.
• ICMP Flood Protection: Limits the volume of incoming ICMP Echo Requests (ping packets). When attackers launch a "ping storm" to saturate an external link or force CPU interrupt generation, the Firebox throttles ICMP processing, dropping excessive packets while allowing legitimate traffic to traverse the interface unimpeded.
• UDP Flood Protection: Rate-limits UDP datagrams targeting closed or unmapped ports. Because UDP is connectionless, attackers frequently blast random high UDP ports to force the firewall to generate ICMP Port Unreachable responses; Fireware suppresses both the traffic and the unreachable replies.

Default Blocked Ports

Fireware includes a pre-configured list of Blocked Ports that are banned at the perimeter. These ports historically correspond to legacy, vulnerable, or widely exploited administrative services:

• Common blocked ports include NetBIOS Name Service (UDP 137), NetBIOS Datagram (UDP 138), NetBIOS Session (TCP 139), Microsoft SMB over IP (TCP 445), and Trivial File Transfer Protocol (UDP 69).
• Any packet arriving on an External interface targeting one of these blocked ports is dropped immediately, without evaluating the policy table.
• Administrators can add custom port definitions or remove specific ports if a legitimate enterprise service requires them.

---

IP Spoofing Defense & Ingress Route Validation

IP address spoofing is a technique where an attacker crafts IP packets with a forged source address to disguise their identity, bypass access control lists, or stage reflected amplification attacks.

Unicast Reverse Path Forwarding (uRPF) Equivalent

Fireware defends against spoofing through a rigorous Ingress Route Validation engine (analogous to Unicast Reverse Path Forwarding):

• Routing Table Cross-Check: When a packet enters an interface, Fireware inspects the source IP address in the packet header and checks the internal routing table to determine which interface would be used to reach that source address.
• Interface Mismatch Drops: If a packet arrives on an External interface with a source IP that belongs to an internal subnet residing behind a Trusted or Optional interface, the Firebox immediately discards the packet as a spoofed transmission.
• RFC 1918 Discard on External Interfaces: Packets arriving on an External interface with private, non-routable source addresses—10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16—are dropped automatically because private IP space cannot legitimately originate from the public Internet.

Drop Unhandled Packets

Fireware also enforces strict checks against Unhandled Packets:

• Drops packets utilizing unassigned or deprecated IP protocol numbers.
• Drops malformed TCP packets with invalid sequence numbers or impossible flag states.
• Drops overlapping IP fragments designed to bypass signature detection systems.

---

Managing Blocked Sites in Firebox System Manager (FSM)

Real-time monitoring and administrative governance of blocked hosts are conducted through Firebox System Manager (FSM) under the Blocked Sites tab.

+-----------------------------------------------------------------------------------------+
|                        FIREBOX SYSTEM MANAGER - BLOCKED SITES TAB                       |
+-------------------+-----------------------+---------------------+-----------------------+
| IP ADDRESS        | REASON FOR BLOCK      | TIME REMAINING      | BLOCK TYPE            |
+-------------------+-----------------------+---------------------+-----------------------+
| 198.51.100.42     | Port Scan             | 14 min 32 sec       | Temporary (Auto)      |
| 203.0.113.119     | Host Sweep            | 08 min 15 sec       | Temporary (Auto)      |
| 192.0.2.77        | SYN Attack            | 19 min 50 sec       | Temporary (Auto)      |
| 45.33.32.156      | Administrative Manual | Permanent           | Permanent (Static)    |
+-------------------+-----------------------+---------------------+-----------------------+

Temporary Auto-Blocked Sites vs. Permanent Blocked Sites

The Blocked Sites table clearly differentiates between two classes of entries:

1. Temporary Auto-Blocked Sites:
   • Generated automatically by Fireware's Default Threat Protection engine when an external host triggers a port scan, IP sweep, or flood threshold.
   • Displayed with an active countdown timer (Time Remaining), counting down from the initial duration (e.g., 20 minutes) to zero.
   • When the countdown reaches zero, the entry is automatically purged from the kernel table, and the remote host can resume communication unless it triggers a new attack.
2. Permanent (Static) Blocked Sites:
   • Manually added by an administrator or imported through an external security intelligence feed.
   • Displayed with a status of Permanent (no countdown timer).
   • Persists indefinitely across appliance reboots and configuration changes until manually deleted by an administrator.

Administrative Interventions in FSM

Within the FSM Blocked Sites interface, engineers can perform critical real-time operations:

• Immediate Unblock (Clear False Positives): If a legitimate business partner's automated vulnerability scan or misconfigured monitoring server triggers an auto-block, the administrator can select the IP address and click Unblock. Fireware immediately flushes the IP from the kernel blacklist, restoring communication instantly without rebooting the firewall or reloading configuration files.
• Manual Block: Administrators can manually input an offending public IP or subnet to instantly terminate an ongoing unauthorized connection.
• Add to Exceptions: An administrator can select a blocked IP and add it directly to the Blocked Sites Exceptions list, guaranteeing that Fireware will never blacklist that address again in the future.

Threat Protection Features Comparison

The following table summarizes Fireware's default threat protection mechanisms: