CHAPTER 10 Network Foundation Protection

CHAPTER 10 Network Foundation Protection

1. If we break a big problem down into smaller pieces, such as security and what an attacker might do, we can then focus on individual components and parts. By doing this, the work of implementing security becomes less daunting. That is what Network Foundation Protection (NFP) is all about: breaking the infrastructure down into smaller components and then systematically focusing on how to secure each of those components.

2. Using Network Foundation Protection to Secure Networks

   • The Network Foundation Protection Framework
     • Management plane
       • This includes the protocols and traffic that an administrator uses between his workstation and the router or switch itself
         • The management plane is listed here first because until the device is configured (which occurs in the management plane), the device will not be very functional in a network. If a failure occurs in the management plane, it may result in losing the ability to manage the network device altogether.
       • EX: SSH
     • control plane
       • An example is a routing protocol. A routing protocol can dynamically learn and share routing information that the router can then use to maintain an updated routing table. If a failure occurs in the control plane, a router might lose the capability to share or correctly learn dynamic routing information, and as a result might not have the routing intelligence to be able to route for the network.
       • This includes protocols and traffic that the network devices use on their own without direct interaction from an administrator.
       • EX: Routing protocol
     • data Plane
       • This includes traffic that is being forwarded through the network (sometimes called transit traffic).
       • EX: trafego user - server
         • An example is a user sending traffic from one part of the network to access a server in another part of the network; the data plane represents the traffic that is either being switched or forwarded by the network devices between clients and servers. A failure of some component in the data plane results in the customer’s traffic not being able to be forwarded. Other times, based on policy, you might want to deny specific types of traffic that is traversing the data plane.
   • correctly maintain the routing tables
   • Implementing NFP
     • Management plane
       • AAA, NTP, SSH, SSL/TLS, syslog, SNMP
       • Understanding the Management Plane
         • Best Practices
           • Enforce password policy
           • Implement role-based access control (RBAC)
             • Ways to implement RBACs include using Access Control Server (ACS) and CLI parser views (which restrict the commands that can be issued in the specific view the administrator is in). Custom privilege level assignments are also an option to restrict what a specific user may do while operating at that custom privilege level.
           • Use AAA services, and centrally manage those services on an ACS server
           • Use NTP
           • use SNMPv3
         • Control which IP addresses are allowed to initiate management sessions with the network device.
         • Lock down syslog
         • Disable any unnecessary services, especially those that use User Datagram Protocol (UDP).
           • These are infrequently used for legitimate purposes, but can be used to launch denial-of-service (DoS) attacks. Following are some services that should be disabled if they are not needed: ■ TCP and UDP small services ■ Finger Unknown 268 CCNA Security 210-260 Official Cert Guide ■ BOOTP ■ DHCP ■ Maintenance Operation Protocol (MOP) ■ DNS resolution ■ Packet assembler/disassembler (PAD) ■ HTTP server and Secure HTTP (HTTPS) server ■ CDP ■ LLDP
     • Control plane
       • Understanding the Control Plane
         • Control plane security is primarily guarding against attacks that might otherwise negatively impact the CPU, including routing updates (which are also processed by the CPU).
         • Best Practices
           • Control Plane Policing (CoPP)
             • Config filtros para controlar trafego e assim consumo de CPU
           • Control Plane Protection (CPPr)
             • Using CoPP or CPPr, you can specify which types of management traffic are acceptable at which levels. For example, you could decide and configure the router to believe that SSH is acceptable at 100 packets per second, syslog is acceptable at 200 packets per second, and so on. Traffic that exceeds the thresholds can be safely dropped if it is not from one of your specific management stations. You can specify all those details in the policy.
             • + completo que CoPP
             • subinterfaces
               • Host subinterface
               • Transit subinterface
               • Express Forwarding (CEF)
             • The benefit of CPPr is that you can rate-limit and filter this type of traffic with a more fine-toothed comb than CoPP.
             • No transit traffic
           • Authenticated routing protocol updates
             • Most routing protocols support authentication. If you use authentication, a rogue router on the network will not be believed by the authorized network devices (routers).
     • Data Plane
       • ACL
       • IOS IPS, zone-based firewall
       • Layer 2 controls (PVLAN, STP, etc)
       • Understanding the Data Plane
         • ways to control the data plane
           • ACLs used for filtering
           • IOS firewall support
           • IOS IPS
           • TCP Intercept
           • Unicast Reverse Path Forwarding (uRPF)
           • Best Practices
             • Block unwanted traffic at the router (ACL)
             • Reduce the chance of DoS attacks (TCP Intercept and firewall services)
             • Reduce spoofing attacks (uRPF)
             • Provide bandwidth management (rate-limiting)
             • When possible, use an IPS to inhibit the entry of malicious traffic into the network
       • Additional Data Plane Protection Mechanisms (L2)
         • Port security
         • (DHCP) snooping
         • DAI
         • IP Source Guard