This message was deleted.
# citrix-netscalers
Slackbot
05/27/2021, 4:01 PMThis message was deleted.
c
CTXMike
05/27/2021, 4:12 PMYou're just seeing outbound ICMP destination unreachables from the gateway VIP, no correlating inbound traffic from those addresses?
c
c4rm0
05/27/2021, 4:14 PMyup its all egress as a test i just did a packet capture with my home public IP as source IP i then pinged the public IP of the GW but i never seen this traffic hit the netscaler so no ingress icmp as external firewall is blocking it before it hits the netscaler
c4rm0
05/27/2021, 4:16 PMthis is what i see
c
CTXMike
05/27/2021, 4:18 PMweird, and if you filter for just "ip.addr == 94.236.245.159" you get nothing but that outbound ICMP unreachable?
CTXMike
05/27/2021, 4:18 PMassuming capture was done on all interfaces
c
c4rm0
05/27/2021, 4:22 PMyeah i tried ip.addr == 94.236.245.159 && icmp and i only see egress (NS GW VIP to 94.236.245.159) with ip.addr == 94.236.245.159 i do see other traffic
c
CTXMike
05/27/2021, 4:25 PMOK, that's a little less weird then, if the traffic from that address to the GW VIP is trying to hit something other than tcp/udp 443 then it's likely expected behavior
c
c4rm0
05/27/2021, 4:27 PMlooking at the unfiltered trace i see a DTLS client hello just before the ICMP
c
CTXMike
05/27/2021, 4:28 PMis the destination port udp/443, and if so do you have DTLS enabled?
c
c4rm0
05/27/2021, 4:30 PMyeah UDP dest port 443 let me check i thought i had it turned off
c4rm0
05/27/2021, 4:32 PMso its enabled thought it was off 😞
c
CTXMike
05/27/2021, 4:33 PMok so in all likelihood those are probably just bots scanning for hosts still vulnerable to the DTLS amplification attack.
CTXMike
05/27/2021, 4:35 PMYou can likely submit a ticket with that trace and get an official response if your security team is worked up about it, but if you followed the instructions in the CVE article and aren't seeing any other symptoms (like tons more outbound than inbound traffic) then it's likely benign
c
c4rm0
05/27/2021, 4:40 PMill turn DTLS off as was meant to upgrade the firmware and enable the DTLS hello verify request but haven't got round to it yet
c4rm0
05/27/2021, 4:43 PMactually DTLS is already disabled i was looking at the callback GW VIP where DTLS is enabled its disabled on the main GW Vserver
c
CTXMike
05/27/2021, 4:47 PMok if DTLS is disabled then that's why you're seeing outbound ICMP unreachables - they're trying to probe a closed port and the ADC is telling them the port is closed.
c
c4rm0
05/27/2021, 4:48 PMahhh yea makes sense i didnt get udp 443 closed on the external fw when the DDOS amplification attacks started
c
CTXMike
05/27/2021, 4:59 PMYeah I can't say for sure the specific behavior, that may be how they respond to packets that fail the clienthelloverify for example. if you need something official then the trace should be enough to get something from support.
CTXMike
05/27/2021, 5:00 PMAlso worth looking into implementing ip reputation checking, if you've got premium license you can do it right from the NS using a listenpolicy
c
c4rm0
05/27/2021, 6:12 PMthanks
c4rm0
05/27/2021, 8:20 PMspoke with support they confirmed its because UDP 443 is still open on external inet FW but because we have DTLS turned off on the NS GW Vserver it will respond back to the client with a ICMP port unreachable. i will have to either disable UDP 443 on inet firewall or upgrade firmware and re enable DTLS and enable the DTLS hello verify
💯 1
👍 1
k
Kari Ruissalo (WyW)
06/09/2021, 8:37 AMWe were seeing similar in an environment that is running 12.1-61.19. We were seeing the "limiting icmp unreach response" messages in the console and major spike on the CPUs.
The UDP/443 was allowed on the firewall and whether we changed the DTLS enabled (with helloverify) or disabled it the situation remained the same.
Finally the UDP/443 was blocked and the appliances restarted and that soothed the situation.
The environment was so loaded that we weren't able to gather support bundles or network traces of the situation, so for now we're just staying UDP/443 blocked.
While the ICMP issue was occuring, we were also seeing a lot of connection attempts on high ports being dropped by the firewall.
c
c4rm0
06/09/2021, 11:07 AMInteresting as i was hoping that upgrading to latest firmware and enabling the DTLS hello verify on the DTLS profile and re enabling DTLS on the NS GW Vserver would stop these ICMP's from being sent i will check for that once i apply the remediations. I dont blame ya leaving UDP 443 blocked EDT/Adaptive transport has been nothing but trouble since it came out (MTU fragmentation issues altho MTU discovery seems to resolve) sometimes you have to ask yourself is it really worth it
2 Views