CISCO NETWORK FOUNDATION PROTECTION

Transcription

1 CISCO NETWORK FOUNDATION PROTECTION Enterprise System Engineer Cisco Systems (Thailand) Ltd. 1

2 Agenda Introduction Configuring Cisco NFP Control Plane Protection Management Plane Protection Data Plane Protection Summary and References Q & A 2

3 Introduction 2005, Cisco Systems, Inc. All rights reserved. 3

4 Risk Landscape Denial of Service (DoS) attacks target the network infrastructure by generating IP traffic streams to the control plane at very high rates The control plane is forced to spend an inordinate amount of time, processing this malicious traffic Results in excessive CPU utilization and CPU resource hijacking by the hackers Examples of such attacks include: TCP SYN floods IP Fragments Internet Control Message Protocol (ICMP) Echo Requests Fraggle Attacks 4

5 Risk Landscape (Cont.) Attacks can devastate a network by causing: High route processor CPU utilization (near 100%) Loss of protocol keepalives and routing protocol updates Route flaps and major network transitions Slow or unresponsive interactive sessions via the CLI Route Processor resource exhaustion Resources such as memory and buffers are unavailable for legitimate IP data packets Indiscriminate packet drops for all incoming packets 5

6 Secure Network = Available Network Ability to Route Network Availability Ability to Manage Network Cisco NFP Foundation Protection, Messaging, 1/05 1/ , Cisco Systems, Inc. All rights reserved. Ability to Forward Data 6

7 Securing the Router Plane by Plane Ability to Route Secure Control Plane Network Availability Ability to Manage Secure Management Plane Ability to Forward Data Secure Data Plane Think Divide and Conquer : Methodical Approach to Protect Three Planes 7

8 Cisco NFP Protection Alcazar Program Secure Networks Must Be Built on a Secure Foundation Control Plane Protection Management Protection Lock down services and routing protocols Secure Access for Management and Instrumentation Data Plane Protection Protect Data forwarding through the device 8

9 Cisco NFP Three Planes Definitions Cisco Protection (NFP) is a Cisco IOS Technology suite that protects network devices, routing and forwarding of control information, and management of traffic bounded to the network devices Data Mgmt Control Control Plane Protection protects the control plane traffic responsible for traffic forwarding AutoSecure with rollback functionality Control Plane Protection CPU / Memory Threshold Management Plane Protection protects the management plane from unauthorized management access and polling Secure Shell (SSH) only access VTY Access Control List (ACL) Cisco IOS Software login enhancement Command Line Interface (CLI) views Data Plane Protection protects the data plane from malicious traffic Unicast RPF for anti-spoofing Control Plane Protection for Data traffic Committed Access Rate (CAR) 9

10 Cisco NFP: Features and Benefits Feature Benefits Control Plane Protection Control Plane Protection AutoSecure Routing protocol protection CPU/Memory Thresholding Reduces the success of a DDoS attack by policing the incoming rate of traffic to the control plane Quickly locks down devices based on industry recognized best practices (NSA guidelines) Validates routing peers and source/destination of routing updates, filtering of prefixes Router remains operational under high loads caused by attacks throug reserving CPU/memory Management Plane Protection Secure Access Image Verification Role Based CLI Views Network Telemetry SNMPv3, TACACS+, VTY ACLs, SSH Verifies the Cisco IOS Software images that the router boots from Allows for granular control of CLI with AAA user crential checking Cisco IOS NetFlow for traffic and DDoS analysis 10

11 Cisco NFP: Features and Benefits (Cont.) Feature Benefits Data Plane Protection Unicast RPF Anti Spoofing for source IP address Access Control Lists ACLs - filter traffic through a device Infrastructure ACL and CAR Remove possibility for illegitimate users to send any traffic to link addresses 11

12 Control Plane Protection 2005, Cisco Systems, Inc. All rights reserved. 12

13 Introduction Control Plane Protection Policing CONTROL PLANE Management SNMP, Telnet ICMP IPv6 Routing Updates Management SSH, SSL.. INPUT to the Control Plane OUTPUT from the Control Plane CONTROL PLANE POLICING (Alleviating DoS Attack) SILENT MODE (Reconnaissance Prevention) Processor Switched Packets PACKET BUFFER OUTPUT PACKET BUFFER INCOMING PACKETS Locally Switched Packets CEF/FIB LOOKUP 13

14 Introduction What CPU Rate Limiters Are Available? CEF Receive CEF Glean CEF No Route IP Errors ICMP Redirect ICMP No Route ICMP ACL Drop RPF Failure L3 Security ACL Input ACL Output VACL Logging IP Options Capture Unicast Rate Limiters Traffic destined to the Router ARP packets Packets with not route in the FIB Packets with IP checksum or length errors Packets that require ICMP redirects ICMP unreachables for unroutable packets ICMP uncreachables for admin deny packets Packets that fail urpf check CBAC, Auth-Proxy, and IPSEC traffic NAT, TCP Int, Reflexive ACLs, Log on ACLs NAT, TCP Int, Reflexive ACLs, Log on ACLs CLI notification of VACL denied packets Unicast traffic with IP Options set Used with Optimized ACL Logging B/BXL Unicast Rate Limiters Multicast FIB-Miss Packets with no mroute in the FIB IGMP IGMP packets Partial Shortcut Partial shortcut entries Directly Connected Local multicast on connected interface IP Options Multicast traffic with IP Options set B/BXL V6 Directly Connect Packets with no mroute in the FIB V6*, G M Bridge IGMP Packets V6*, G Bridge Partial shortcut entries V6 S, G Bridge Partial shortcut entries V6 Route Control Partial shortcut entries V6 Default Route Multicast traffic with IP Options set V6 Second Drop Mulicast traffic with IP Options set Shared across the 10 hardware Revocation Lists. Layer 2 Rate Limiters General Rate Limiters L2PT L2PT encapsulation/decapsulation MTU Failure Packets requiring fragmentation PDU Layer 2 PDUs TTL Failure Packets with TTL<=1 14

15 Configuring Control Plane Protection Policing Four Step Process Define a packet classification criteria router(config)# router(config)# class-map class-map <traffic_class_name> router(config-cmap)# match match <access-group> <access-group> Define a service policy router(config-pmap)# policy-map<service_policy_name> router(config-pmap)# class class <traffic_class_name> router(config-pmap)# police police <rate> <rate> conform-action conform-action transmit transmit exceed-action exceed-action drop drop Enter control-plane configuration mode router(config)# router(config)# control-plane control-plane router(config-cp)# router(config-cp)# Apply QoS Policy router(config-cp)# router(config-cp)# service-policy service-policy input input <service_policy_name service_policy_name> 15

16 Control Plane Policing Configuration Must enable QoS globally! (mls qos) Otherwise, CoPP is performed in software only Define ACLs to match traffic Permit means traffic will belong to class; deny means will fall through Define class-maps (class-map <name>) Use match statements to identify traffic associated with the class match {access-group ip {precedence dscp}} Define policy-map (policy-map <name>) and associate classes and actions to it Policing is the only supported action Usual Cisco Catalyst 6500 Series Switch policing syntax Tie the policy-map to the control-plane interface mls qos ip access-list extended CPP-MANAGEMENT remark Remote management permit tcp any any eq SSH permit tcp any eq 23 any permit tcp any any eq 23 class-map match-all CPP-MANAGEMENT description Important traffic, eg management match access-group name CPP-MANAGEMENT policy-map copp description Control plane policing policy class CPP-MANAGEMENT police conform-action transmit exceed-action drop control-plane service-policy input copp 16

17 Control Plane Policy Template class-map match-all cpp-bgp - BGP class-map match-all cpp-igp - EIGRP, OSPF, etc... class-map match-all cpp-management - SNMP, NTP, SSH, TACACS, TFTP, etc class-map match-all cpp-reporting - Echo, echo-reply with DSCP marking per class class-map match-all cpp-monitoring - ICMP, traceroute, etc class-map match-all cpp-critical-applications - HSRP, DLSw, SIP/VoIP, etc class-map match-all cpp-layer-2-protocols - ARP class-map match-all cpp-default - Non-specifically marked traffic class-map match-any cpp-deny - Classified attack traffic 17

18 Configuring CPU Rate Limiter Apply a CPU Rate Limiter at at a specific rate Router(config)# mls mlsrate-limit <all <all unicast multicast layer layer 2> 2> <special_case_rate_limiter> <packets_per_second> Example: Rate Limit traffic with TTL=1 to to 1000pps Router(config)# mls mlsrate-limit all all ttl-failure

19 Test Setup Mitigation of Multiple Attacks CPP configuration policy-map CoPP class cpp-bgp police conform-action transmit exceed-action transmit class cpp-igp police conform-action transmit exceed-action transmit class cpp-managment police conform-action transmit exceed-action transmit class cpp-monitoring police conform-action transmit exceed-action drop class cpp-critical police conform-action transmit exceed-action transmit class cpp-undesirable police conform-action drop exceed-action drop class cpp-default police conform-action transmit exceed-action drop CPU Rate Limiter configuration mls rate-limit multicast ipv4 partial mls rate-limit unicast ip options mls rate-limit all ttl-failure

20 AutoSecure 2005, Cisco Systems, Inc. All rights reserved. 20

21 Protecting routers: Autosecure AutoSecure command in 12.3(1), 12.2(18)S Cisco.com/en/US/products/sw/iosswrel/ps5187/products_feat ure_guide09186a008017d101.html One Touch Device Lockdown Simplify securing an IOS router and networks attached to an IOS router. Built from security audit scripts and security whitepapers that Cisco and others provide. Large networks uses these to lock down their network. Core Target is the CPE Routers on the edge of the Internet. 800/1800/2800/3700/3800 platforms, but applicable in large extent to all IOS platforms 21

22 AutoSecure : Global Services Global Services turned off Finger, PAD, Small Servers, Bootp, HTTP service, Identification Service, CDP, NTP, Source Routing Global Services turned on password-encryption service Tuning of scheduler interval/allocation tcp synwait-time tcp-keepalives-in and tcp-kepalives-out SPD configuration no ip unreachables for NULL0 22

23 AutoSecure : Services & Logging Services Disabled Per Interface ICMP Proxy-Arp Directed Broadcast - disables MOP service. disable icmp unreachables disable icmp mask reply messages. Provide Logging for security Enable sequence numbers & timestamp Provide a console log Set log buffered size Provide an interactive dialogue to configure the logging Log debug traffic 23

24 AutoSecure : Lockdown accessibility Secure Access to the router Check for a banner and provide facility to add text to Automatically Configure: login, password transport input & output exec-timeout local AAA ssh timeout and ssh authentication-retries to minimum enable only SSH, SCP for access and file transfer to/from the router. disables SNMP (if not being used.) 24

25 AutoSecure : Forwarding Plane Securing the Forwarding Plane Enables Cisco Express Forwarding (CEF) or Distributed Cisco Express Forwarding (DCEF) Anti-Spoofing Block all IANA reserved ip address blocks more information on this in Securing Routing part of the Techtorial Block private address blocks if customer desires If not using a default route, install a default route to NULL 0. If tcp intercept feature is available and user interested configure TCP intercept for connection-timeout. If router is being used as firewall, start interactive configuration for CBAC on interfaces facing internet. Enable netflow on software forwarding platforms. Password Security. 25

26 CPU and Memory Threshold Notification 2005, Cisco Systems, Inc. All rights reserved. 26

27 Reference slide CPU and Memory Threshold Notification CPU threshold notification 12.0(26)S, 12.3(4)T Generates an SNMP trap message when a predefined threshold of CPU usage is crossed process cpu threshold type total rising 80 interval 5 falling 70 interval 5 snmp-server host traps public cpu Memory threshold notification (26)S and 12.2(18)S If available free processor or I/O memory falls below the specified thresholds, the router will log an event; network operations staff can investigate, and if necessary take action, before router performance is impacted or free memory becomes so low that the router is in danger of crashing memory free low-watermark processor memory free low-watermark io memory reserve critical

28 CPU Thresholding snmp-server enable traps cpu threshold process cpu threshold type total rising 80 interval 5 falling 70 interval Rising SNMP Trap TIME 5 Falling SNMP Trap CPU 28

29 Memory Thresholding memory free low-watermark processor (KB) Memory (Mb) : *Aug 12 22:31:19.559: %SYS-4-FREEMEMLOW: Free Memory has dropped below 20000k Pool: Processor Free: freemem_lwm: : *Aug 12 22:33:29.411: %SYS-5-FREEMEMRECOVER: Free Memory has recovered 20000k Pool: Processor Free: freemem_lwm: 0 memory reserved critical TIME Rising Memory will trigger at 5% Above low watermark Memory Free 29

30 Management Plane Protection 2005, Cisco Systems, Inc. All rights reserved. 30

31 Access to the Router Console, VTY Telnet (not recommended, use SSH!) SSHv2 end-to-end security Local passwords Username based on the router Username XXX secret YYYY External AAA TACACS+, RADIUS, Kerberos One-Time Passwords (OTP) Use enable secret 31

32 VTY Security Reference slide Access to VTYs should be controlled ACL used to filter incoming data Logging can be used to provide more information access-list 3 permit access-list 3 deny any line vty 0 4 access-class 3 in transport input ssh transport output none Only accept SSH, no telnet! 32

33 Reference slide What Ports Are Open on the Router? It may be useful to see what sockets/ports are open on the router Show ip sockets show some of the UDP ports opened IOSRouter#show ip sockets Proto Remote Port Local Port In Out Stat TTY listen

34 Reference slide What Ports Are Open on the Router? Two steps required for TCP ports: show tcp brief all show tcp tcb c1711#sh tcp brief all TCB Local Address Foreign Address (state) 86F5C ESTAB 82A72B0C *.443 *.* LISTEN C *.80 *.* LISTEN 827AB9EC *.1723 *.* LISTEN 34

35 Reference slide What Ports Are Open on the Router? c1711#sh tcp tcb 86F5C210 Connection state is ESTAB, I/O status: 1, unread input bytes: 0 Connection is ECN Disabled Local host: , Local port: 22 Foreign host: , Foreign port: 4807 Enqueued packets for retransmit: 1, input: 0 mis-ordered: 0 (0 bytes) Event Timers (current time is 0x6A77C230): Timer Starts Wakeups Next Retrans x6A77C8B4 TimeWait 0 0 0x0 AckHold x0 SendWnd 0 0 0x0 KeepAlive x6A78AC8C GiveUp 0 0 0x0 PmtuAger 0 0 0x0 DeadWait 0 0 0x0 iss: snduna: sndnxt: sndwnd: irs: rcvnxt: rcvwnd: 4028 delrcvwnd:

36 Network Time Protocol Reference slide Synchronize time across all devices When security event occurs, data must have consistent timestamps From external time source Upstream ISP, Internet, GPS, atomic clock From internal time source Router can act as stratum 1 time source ntp source loopback0 ntp server source loopback0 Secure NTP! ntp authentication-key 10 md5 keystring ntp authenticate ntp trusted-key 10 36

37 Configuring Syslog on a Router Syslog data is invaluable Attack forensics Day to day events and debugging To log messages to a syslog server host, use the logging global configuration command logging host logging trap level To log to internal buffer use: logging buffered size Ensure timestamps service timestamps log Do not log to console! It can cause overruns and high CPU loads 37

38 SNMP Version 1 sends cleartext community strings and has no policy reference Version 2 addresses some of the known security weaknesses of SNMPv1 Version 3 provides authentication, encryption Not yet widely deployed In IOX today (CRS-1) Confirm NMS application support RFC-2570 Introduction to Version 3 of the Internet-Standard Network Management Framework Recommended 38

39 Config Change Notification and Logging Allows the tracking of configuration changes entered on a per-session and per-user basis by implementing a configuration log Tracks each configuration command that is applied, who applied the command, the parser return code for that command, and the time that the command was applied Adds a notification mechanism that sends asynchronous notifications to registered applications whenever the configuration log changes Available 12.3(4)T on 1800, 2800, 3800, 7200, 7500, AS5xxx 207/products_feature_guide09186a00801d1e81.html Also Contextual Configuration Diff utility 207/products_feature_guide09186a00801d1dc2.html 39

40 ICMP Unreachable Overload Packets that cannot be delivered due to: Null0 next-hops (in some cases) No route in table Risk high number of unreachables overloading CPU no ip unreachables In certain situations we might want ICMP unreachables enabled, but need to limit the generation in order to protect the router: ICMP Unreachable Rate-Limiting Command: ip icmp rate-limit unreachable [DF] < milliseconds> no ip icmp rate-limit unreachable [df] 40

41 New Feature IOS Login Enhancements Login enhancements password retry delay Adds new flexibility to lock-out unwanted attempts to access the device Introduces a delay between successive failed Login attempts to alleviate dictionary attacks New global command login delay Generation of syslog messages for login detection Available from 12.3(4)T ps5207/products_feature_guide09186a00801d1cb3.html 41

42 Limit Authority: Authorize Commands Differentiate staff authority on the router Help desk Operations Second level/third level support Use privilege levels (0 15) System Administrator Level 2: show, debug, ping Network Engineer Level 15: all commands Router 42

43 New Feature Role-Based CLI Access New feature: Role-based CLI, aka CLI views Defines CLI access based on administrative roles Security Enhances the security of the device by defining the set of CLI commands that are accessible to a particular user Availability Avoids unintentional execution of CLI commands by unauthorized personnel Operational efficiency Prohibits users from viewing CLI commands that are inaccessible to them, greatly improving usability Available from 12.3(7)T /products_feature_guide09186a00801ee18d.html 43

44 NetFlow 2005, Cisco Systems, Inc. All rights reserved. 44

45 Cisco IOS NetFlow NetFlow is a standard for acquiring IP network and operational data Benefits Understand the impact of network changes and services Improve network usage and application performance Reduce IP service and application costs Optimize network costs Detect and classify security incidents 1. Characterize Flows & understand traffic behaviour 2. Export Flow information 3. Traffic Analysis Network Planning Security Analysis Reports Enable NetFlow 45

46 Flow is Defined by Seven Unique Keys Source IP address Destination IP address Source port Destination port Layer 3 protocol type Type of Service (ToS) byte (Differentiated Services Code Point (DSCP)) Input logical interface (ifindex) Enable NetFlow NetFlow Export Packets Traffic Traditional Export & Collector New SNMP MIB Interface SNMP Poller GUI 46

47 NetFlow Cache Example 1. Create and update flows in NetFlow cache Srclf SrclPadd Dstlf DstlPadd Protocol TOS Flgs Pkts Src Port Src Msk Src AS Dst Port Dst Msk Dst AS NextHop Bytes/ Pkt Active Idle Fa1/ Fa0/ A2 / A 2 / Fa1/ Fa0/ / / Fa1/ Fa0/ A1 / A 1 / Fa1/ Fa0/ / / Expiration Inactive timer is expired (15 sec is default) Active timer is expired (30 min (1800 sec) is default) NetFlow cache is full (oldest flows are expired) RST or FIN TCP Flag Srclf SrclPadd Dstlf DstlPadd Protocol TOS Flgs Pkts Src Port Src Msk Src AS Dst Port Dst Msk Dst AS NextHop Bytes/ Pkt Active Idle Fa1/ Fa0/ A2 / A2 / Aggregation 4. Export version 5. Transport protocol No Non-Aggregated Flows Export Version 5 or 9 Export Packet Header Payload (Flows) Yes e.g. Protocol-Port Aggregation Scheme Becomes Protocol 11 Pkts SrcPort 00A2 DstPort 00A2 Bytes/Pkt 1528 Aggregated Flows Export Version 8 or 9 47

48 How Does a DoS Attack Look Like? Potential DoS attack (33 flows) on router1 Estimated: 660 pkt/s Mbps ASxxx is: ASddd is: Real data deleted in this presentation src_ip dst_ip in out src dest pkts bytes prot src_as dst_as int int port port 192.xx.xxx yyy.yyy xxx ddd 192.xx.xxx yyy.yyy xxx ddd 192.xx.xxx yyy.yyy xxx ddd 192.xx.xxx yyy.yyy xxx ddd 192.xx.xxx yyy.yyy xxx ddd 192.xx.xxx yyy.yyy xxx ddd 192.xx.xxx yyy.yyy xxx ddd 192.xx.xxx yyy.yyy xxx ddd 192.xx.xxx yyy.yyy xxx ddd 192.xx.xxx yyy.yyy xxx ddd 192.xx.xxx yyy.yyy xxx ddd 192.xx.xxx yyy.yyy xxx ddd 192.xx.xxx yyy.yyy xxx ddd 48

49 Tracing Back with Netflow Routers need Netflow to be enabled Victim router1#sh ip cache flow include <destination> Se1 <source> Et0 <destination> (lots more flows to the same destination) The flows come from serial 1 router1#sh ip cef se1 Prefix Next Hop Interface / Serial /30 attached Serial1 Find the upstream router on serial 1 Continue on this router 49

50 show ip cache flow router_a#sh ip cache flow IP packet size distribution (85435 total packets): IP Flow Switching Cache, bytes 2728 active, 1368 inactive, added ager polls, 0 flow alloc failures Active flows timeout in 30 minutes Source Interface Flow info summary Inactive flows timeout in 15 seconds last clearing of statistics never Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) Flows /Sec /Flow /Pkt /Sec /Flow /Flow TCP-X TCP-other SrcIf Total: Et0/0 SrcIf SrcIPaddress DstIf DstIPaddress Pr SrcP DstP Pkts Et0/0 Et0/ Se0/ AEE Et0/ Se0/ D Et0/0 Et0/ Se0/ CB Flow details 50

51 show ip cache verbose flow router_a#sh ip cache verbose flow IP packet size distribution (23597 total packets): IP Flow Switching Cache, bytes 1323 active, 2773 inactive, added ager polls, 0 flow alloc failures Active flows timeout in 30 minutes Inactive flows timeout in 15 seconds last clearing of statistics never Protocol Total Flows Packets Bytes Packets Active(Sec) Idle(Sec) Flows /Sec /Flow /Pkt /Sec /Flow /Flow TCP-other Total: SrcIf SrcIPaddress DstIf DstIPaddress Pr TOS Flgs Pkts Port Msk AS Port Msk AS NextHop B/Pk Active Et0/ Se0/ FA7 / / Et0/ Se0/ Port Msk AS Port Msk AS NextHop B/Pk Active 51

52 NetFlow MIB Currently available in Cisco IOS Software Releases 12.3(7)T NetFlow information is available: When using SNMP Without NetFlow export Administration of Netflow using the MIB interface NetFlow MIB cannot be used to retrieve all Flow information, but is very useful for security monitoring and locations where export is not possible Packet size distribution Number of bytes exported per second Number of NetFlow MIB flows with Export of Top N talkers Top N Talkers Top N Flows are based on various NetFlow field values (AS Number, destination, ports) MIB and CLI support Releases 12.2(25)S and 12.3(11)T 52

53 NetFlow Security Enhancement Release 12.4(2nd)T Q4 05 New show commands to understand and parse NetFlow data show flows on port X to destination Y: show ip flow top <N> <aggregate-field> <sort-criteria> <matchcriteria> show ip flow top 10 destination-address packets interface ser0 port-range 100 to

54 Network Based Application Recognition (NBAR) 2005, Cisco Systems, Inc. All rights reserved. 54

55 Overview of NetFlow and Network Based Application Recognition NetFlow Pioneering IP accounting technology Invented and patented by Cisco IETF export standard Network-Based Application Recognition (NBAR) Intelligent application recognition Analyzes and identifies application traffic in real time Classification based on deep packet inspection; NBAR can look deeper into the packet to identify applications HTTP traffic by URL, host name, header fields or MIME type using regular expressions (*,?, [ ]), Citrix ICA traffic, RTP payload type classification Currently supports 90 protocols/applications 55

56 NetFlow and NBAR Differentiation Link layer header IP header TCP/UDP header Data packet Interface TOS Protocol Source IP address Destination IP address Source port Destination port Deep packet (payload) inspection NetFlow NBAR NetFlow and NBAR both leverage Layer 3 and 4 header information NetFlow Monitors data in Layers 2 through 4 Determines applications by port Utilizes a 7-tuple for flow NBAR Examines data from Layers 3 through 7 Uses Layers 3 and 4 plus packet inspection for classification Stateful inspection of dynamicport traffic 56

57 NetFlow and NBAR Benefit Footprints Enterprise backbone Enterprise premise edge Service Provider aggregation edge Service Provider core NetFlow Cisco Catalyst 4500, 5000, 6500, 7600 Series ASIC Cisco Catalyst 5000, 6500 Series HW Acceleration Cisco Catalyst 4500 Series ASIC Cisco 7100, 7200, 7300, Series Cisco AS5300,AS5400, AS5800 Series Cisco 830, 1400, 1700, 1800, 2600XM, 2800, 3700, 3800 Series Cisco Catalyst 4500, 5000, 6500 Series; Cisco 7600 Series ASIC Cisco 7100, 7200, 7300, Series Cisco AS5300 and AS5800 Series Cisco MGX8000 Series Cisco and Series Internet Routers ASIC Cisco Catalyst 5000 and 6500 Series; Cisco 7600 Series ASIC Cisco 7500 Series NBAR Cisco Catalyst 6500 and 7600 Series MSFC Planned Network ASIC Foundation Cisco Catalyst 6500 and 7600 Series FlexWAN, MWAM Planned ASIC Cisco 7100, 7200, and 7500 Series Cisco 830, 1700, XM, 2800,3700 and 3800 Series Cisco Catalyst 6500 and 7600 Series FlexWAN, MWAM Planned ASIC Cisco 7100, 7200, and 7500 Series Cisco Catalyst 6500 and 7600 Series FlexWAN, MWAM Planned ASIC Cisco 7500 Series 57

58 Network Based Application Recognition IP packet Stateful and dynamic inspection TCP/UDP packet Data packet ToS Protocol Source IP addr Dest IP addr Src port Dst port Sub-port/deep inspection egp exchange kerberos secure-nntp smtp gre finger l2tp notes snmp icmp ftp ldap novadigm socks ipinip secure-ftp secure-ldap ntp sqlnet ipsec gopher netshow pcanywhere ssh eigrp http pptp pop3 streamwork bgp secure-http sqlserver secure-pop3 syslog cuseeme imap netbios printer telnet dhcp irc nfs realaudio secure-telent dns secure-irc nntp rcmd tftp H.323 SIP MGCP Fasttrack Cisco IOS Software Release 12.4(2)T: NBAR and Distributed Network-Based Application Recognition citrix Edonkey napster BitTorrent vdolive xwindows 58

59 Packet Description Language Modules Packet Description Language Modules (PDLMs) define applications recognized by NBAR New applications supported by adding new PDLMs No Cisco IOS Software upgrade or reboot required to add new PDLMs New Cisco IOS Software required only when enhanced NBAR infrastructure is required for new PDLM functionality New PDLMs are incorporated natively into subsequent Cisco IOS Software releases Only new/updated PDLMs are loaded Must be produced by Cisco engineers 59

60 NBAR User-Defined Custom Application Classification IP packet TCP/UDP packet Data packet ToS Protocol Source IP Addr Dest IP Addr Src Port Dst Port FFFF0000MoonbeamFFFF Name Name the match criteria up to 24 characters lunar_light Offset Specify the beginning byte of string or value to be matched in the data packet, counting from zero for the first byte Skip first 8 bytes Format Define the format of the match criteria ASCII, hex or decimal ascii Value The value to match in the packet If ASCII, up to 16 characters Moonbeam [Source or destination port] Optionally restrict the direction of packet inspection; defaults to both directions if not specified [source destination] TCP or UDP Indicate the protocol encapsulated in the IP packet tcp Range or selected port number(s) range with start and end port numbers, up to to 16 individual port numbers range ip nbar custom lunar_light 8 ascii Moonbeam tcp range class-map solar_system match protocol lunar_light policy-map astronomy class solar_system set ip dscp AF21 interface <> Example service-policy output astronomy 60

61 NBAR HTTP Classification Extended Inspection: NBAR looks for an HTTP-specific signature in ports beyond well-known TCP port 80 HTTP GET request contains host/url string HTTP GET request HTTP Clients Router X Responses to HTTP GET Optionally, HTTP responses may be further classified by MIME-type Router Y router(config-cmap)#match protocol http? host host-name-string -- Match Host Name url url-string -- Match URL String mime MIME-type -- Match MIME Type c-header-field -- Client general header field s-header-field -- Server general header field HTTP server Match protocol http: 61

62 NBAR Protocol Discovery MIB Provides statistics per application, per interface via SNMP Enable or disable protocol discovery per interface Display protocol discovery statistics Configure and view multiple top-n tables listing protocols by bandwidth usage Configure thresholds: report breaches and send notifications when these thresholds are crossed Supported by Cisco QoS partners Concord Communications InfoVista: traffic monitoring; DoS attack mitigation NBAR Protocol Discovery MIB apter09186a htmlcisco-nbar-protocol-discovery-mib Cisco NBAR Protocol Discovery MIB 62

63 Unicast Reverse Path Forward (urpf) 2005, Cisco Systems, Inc. All rights reserved. 63

64 Unicast RPF Overview Cisco Express Forwarding is required Checks to determine whether any packet that is received at a router interface arrives on one of the best return paths to the source of the packet Performs a reverse lookup in the Cisco Express Forwarding table - if urpf does not find a reverse path for the packet, urpf can drop the packet Two types of urpf: Strict mode urpf requires that the source IP address of an incoming packet has a FIB path to the SAME interface as that on which the packet arrived Loose mode urpf requires that the source IP address of an incoming packet has a FIB path to ANY interface on the device, except null 64

65 Unicast RPF Benefits Operationally simple to maintain urpf path validation criteria is based upon the dynamically updated IP routing tables Network address and routing changes are automatically taken into account, with no static entries to maintain Implementation introduces minimal performance impact on the router or switch 65

66 urpf Strict Mode router(config-if)# ip verify unicast reverse-path or: ip verify unicast source reachable-via rx allow-default int 2 int 2 int 1 int 3 int 1 int 3 S x D data S x D data S y D data FIB FIB Sy D data Dest Path S x int 1 S y int 2 S z null0 Dest Path Sx int 1 S y int 2 S z null0 sourceip=rx int? sourceip=rx int? IP verify unicast source reachable via rx 66

67 urpf Loose Mode router(config-if)# ip verify unicast source reachable-via any int 2 int 2 int 1 int 3 int 1 int 3 S y D data S y D data S z D data Sz D data FIB Dest Path S x int 1 S y int 2 S z null0 sourceip=any int? FIB Dest Path Sx int 1 S y int 2 S z null0 sourceip=any int? IP verify unicast source reachable via any 67

68 Integrated Switch Security 2005, Cisco Systems, Inc. All rights reserved. 68

69 Port Security MAC Port A 1 B 2 C 3 MAC B Port 2 MAC A Port 1 Port 3 X C->A X -> A Port Security allows 1 Mac ONLY Blocks 2nd Mac Address MAC C 69

70 Enabling Port Security Enabling Port Security Interface < Interface ID > switchport port-security Defines Maximum Number of MAC address Interface < Interface ID > switchport port-security maximum N Defines Violation Actions Interface < Interface ID > switchport port-security violation {restrict shutdown} Binds Static MAC Address Interface < Interface ID > switchport port-security mac-addressmac_address 70

71 Man in the Middle Attack Exploiting DHCP Services Pool1 Pool 2 Pool3 Pool4 Accepts Binding (Which Ever Come First) IP Addr DNS/WINS Gateway DHCP Offer DHCP Req DHCP Offer Allocates Legitimate IP Address Valid DNS It Self As GateWay 71

72 Enabling DHCP Snooping Trust/Untrust Enabling IP DHCP Snooping ip dhcp snooping Enabling IP DHCP Snooping on Specific VLAN ip dhcp snoop vlan X Enabling DHCP Rate Limiting interface < Interface ID > ip dhcp snooping trust // Server 72

73 Preventing Eavedropping : Dynamic ARP Inspection DHCP Server Learns IP-MAC bindings via DHCP Req/Offer. Allows Packets with matching IP : MAC X User uses Static IP Address X User uses DHCP Allocated IP Address User uses someone s IP Address 73

74 Enabling Dynamic ARP Inspection Enabling IP DHCP Snooping ip dhcp snooping Enabling IP DHCP Snooping on Specific VLAN ip dhcp snoop vlan X Enabling Dynamic Arp Inspection ip arp inspection vlan X 74

75 Summary and References 2005, Cisco Systems, Inc. All rights reserved. 75

76 Cisco Worm Protection in Action System Under Attack Si Si Si Infected Sources Core Protect End Systems the End Overloaded Systems Cisco High Security CPU Applications AgentImpacted System Crashes Access Distribution Police the Links Network Telemetry Traffic Rate Limiting Prefix filtering Protect Network the Network Links Overloaded Devices Loss Auto of Availability Secure Control High Plane Packet Protection Loss CPU/Memory Latency Threshold Role Applications based CLI Impacted Access Secure Management Access Network Prevent Devices the Overloaded Attack Anti Compromised: Spoofing Black Ability Holing to Route DDoS Ability Routing to be Protocol managed Ability Authentication to Forward Data Attacks Protect targeted and to Police end systems your business cause collateral with a secure damage and across available the network infrastructure 76

77 Hardware Support Hardware Cisco 7600 Series Router Cisco Catalyst 6500 Series Switch Cisco 7200 Series Router Cisco 7500 Series Router Cisco Series Internet Router Cisco 1751 Series Router Cisco 2600-XM Series Cisco 3700 Series Router Cisco 7200 Series Router Availability Cisco IOS Software Release 12.2(18)SXD1 Cisco IOS Software Release 12.2(18)S Cisco IOS Software Release 12.0(29)S Cisco IOS Software Release 12.3(4)T 77

78 References Cisco IOS Security Infrastructure Cisco IOS Software Release 12.2(18)SXD Deploying Control Plane Protection - Policing r09186a f39.shtml Control Plane Protection Policing Feature Guide de09186a00801afad4.html QoS Command Reference Guide reference_book09186a00801a7ec7.html 78

79 Resources Cisco NFP Cisco IOS Software Release 12.3T: New Security Features and Hardware, Product Bulletin No a00801d7229.html Control Plane Protection Documentation ture_guide09186a00801afad4.html 79

80 Glossary Acronym Description CoPP Control Plane Policing RTBH Remote Triggered Black Hole RTRL Remote Triggered Rate Limiting racl iacl urpf Receive ACL Infrastructure ACL Unicast Reverse Path Forwarding 80

81 Security is about the ability to control the risk incurred from an interconnected global network. Cisco NFP provides the tools, technologies, and services that enable users to secure their foundation 81

82 Q and A 82

83 2005, Cisco Systems, Inc. All rights reserved. 83