400-007 · Question #316
A network hacker is trying to interrupt the transport packet on IPSEC. A packet with duplicate sequence numbers is introduced. The customer sends high-priority traffic during this window. Which…
The correct answer is B. Apply anti-replay window 4096. IPsec anti-replay protection uses a sliding window of acceptable sequence numbers, and increasing the window size to 4096 accommodates out-of-order packet arrival while still rejecting true replay packets. This is the correct mitigation when legitimate high-priority traffic…
Question
A network hacker is trying to interrupt the transport packet on IPSEC. A packet with duplicate sequence numbers is introduced. The customer sends high-priority traffic during this window. Which design parameter should be considered to mitigate this issue?
Options
- AClassify and Mark duplicate sequence packets.
- BApply anti-replay window 4096.
- CRestrict keywork in IPSEC Tunnel.
- DIncrease QoS shape policy.
How the community answered
(52 responses)- A4% (2)
- B83% (43)
- C10% (5)
- D4% (2)
Why each option
IPsec anti-replay protection uses a sliding window of acceptable sequence numbers, and increasing the window size to 4096 accommodates out-of-order packet arrival while still rejecting true replay packets. This is the correct mitigation when legitimate high-priority traffic causes sequence number gaps.
Classifying and marking packets with duplicate sequence numbers does not prevent them from being accepted or processed; it only categorizes traffic and does not address the replay-attack mitigation function.
The IPsec anti-replay window defines how far out-of-order a packet's sequence number can be before it is dropped as a replay; setting the window to 4096 (via 'crypto ipsec security-association replay window-size 4096' in Cisco IOS) prevents the receiver from discarding legitimate high-priority packets that arrive with sequence numbers outside a smaller default window, while still blocking actual duplicate sequence number injection attacks.
Restricting keywords in an IPsec tunnel is not a valid or recognized configuration parameter and has no bearing on sequence number handling or replay protection.
Increasing a QoS shaping policy controls the transmission rate of traffic but does not influence how the IPsec receiver handles sequence number validation or replay window behavior.
Concept tested: IPsec anti-replay window size configuration
Source: https://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/116858-problem-ipsec-00.html
Topics
Community Discussion
No community discussion yet for this question.