Cisco 6500 and DDOS mitigation

[killerasp]

hey guys.

im trying to find an easy to dynamically block possible DDOS attacks. im starting to see some excessive traffic hitting my primary DNS servers. we have a mitigation service in place to handle REAL DDOS attacks (eg: DNS amplification attacks) if indeed it is happening. But if im seeing random dns traffic originating from several isp that not normal, i want to be able to block them withmout modifying my transit ACLS. i know ACL's are prolly the best way to go, but i dont want to take the chance with modifying the existing rules in my ACLS.

i am pretty sure Cisco IOS does not support group based ACL's like in the Cisco ASA/PIX. Any suggestions how i could modify only a portion of an ACL without altering the entire access list?

 

[xphil3]

hey guys.

im trying to find an easy to dynamically block possible DDOS attacks. im starting to see some excessive traffic hitting my primary DNS servers. we have a mitigation service in place to handle REAL DDOS attacks (eg: DNS amplification attacks) if indeed it is happening. But if im seeing random dns traffic originating from several isp that not normal, i want to be able to block them withmout modifying my transit ACLS. i know ACL's are prolly the best way to go, but i dont want to take the chance with modifying the existing rules in my ACLS.

i am pretty sure Cisco IOS does not support group based ACL's like in the Cisco ASA/PIX. Any suggestions how i could modify only a portion of an ACL without altering the entire access list?

Im not sure what you mean by possible attacks, but If you want to look for anomalous traffic, you're doing to need the IDSM-2 or the anomaly guard card . The DDoS features that you have in place should detect and mitigate the "possible attacks as well" as long as they are tuned correctly. If you're not already using them:
You should be implementing CAR for ICMP, unicast RPF and tcp intercept. Unfortunately, I can't say much else as this is the exact type of stuff I do at Cisco and get paid for. Sorry

As for ACL groups, this *should* be part of the 12.5 mainline.