MPLS VPN Security Best Practice Guidelines

Transcription

1 Security Best Practice Guidelines con 2006 May Monique Morrow and Michael Behringer Distinguished Consulting Engineer and Distinguished Systems Engineer Cisco Systems, Inc. ( 1 Security - Agenda Security evolution and drivers Secure Design Considerations Ongoing standardization work Summary 2

2 Security Protection mechanisms for -specific network resources Protection of forwarding and signaling security protection areas Integrity and privacy of service traffic node access and resiliency Focus areas in network infrastructure core (LSPs between pairs) service edge (- link) network interconnect (Inter-AS/SP) Incremental value-add and integral part of scalable and robust technology solution 3 Evolution Initial Deployments Large SP and Enterprise deployments Next-Generation Deployments Challenges Service Provider technology adoption Code features and stability scale and high availability Enterprise technology adoption Manageability and operations Complexity of new enhanced services (Extranets, LSM) for network convergence Security Focus as a secure technology replacement for legacy L2 technologies (FR/ATM)? Inter-SP network connects New RFP compliance reqs Enterprise network security Increasing service configuration complexity New security reqs for support of converged triple play services and Beyond 4

3 Security Drivers Financials Education/Research Other Customers Service Provider Segment Tier-1 (Global) Tier-2 (National) Enterprise Segment Government Segment Government agencies and institutions Security Drivers Network convergence Network convergence and network interconnect Regulatory compliance Extranet security User traffic segmentation Regulatory compliance Extranet security technology value-add Regulations driving new network security reqs Examples Triple play and public/private services convergence Inter-AS/SP network inter-connect Sarbanes-Oxley Act Financial application access Secure campus connectivity Extranet partner connectivity US Homeland Security 5 Why Is Security Important? Customer buys Internet Service : Packets from SP are not trusted Perception: Need for firewalls, etc. Customer buys a Service : Packets from SP are trusted Perception: Few or no further security measures required SP Must Ensure Secure Operations 6

4 Security Risk security architecture components Network design Implementation Operation Level of network deployment complexity determines perceived security risks Influencing factors of deployment complexity Network architecture (e.g., physical v.s. logical separation) Networking services run on top of network Types of networking services Public IP services (Internet) Private () connectivity services 7 Deployment Scenarios Shared & Edge Shared & Separate Edge Separate & Edge Public/Private Public Private Public Private Network Single core for both public IP and private traffic Optional BGP/Internet free core Single core for both public IP and private traffic Optional BGP/Internet free core Separate cores for public IP and private traffic Optional BGP/Internet free core Edge Network routers terminate both public IP and private connections Dedicated routers used for termination of public IP and private connections Dedicated routers used for termination of public IP and private connections 8

5 Network Complexity versus Capital Costs Network Complexity (Risk) Logical Separation Shared & Edge Public/Private Simplifications for implementing security mechanisms reducing deployment risks. security mechanism enable secure logical separation of traffic forwarding and signaling Shared & Separate Edge Public Private Separate & Edge Public Private Sweet Spot Physical Separation Lower cost deployments with reduced complexity and increased resiliency Capital Costs 9 Secure / Design Don t let packets into the core (for : routers) No way to attack core, except through routing, thus: Secure the routing protocol Neighbor authentication, maximum routes, dampening, Design for transit traffic QoS to give priority over Internet Choose correct router for bandwidth Separate s where necessary Operate Securely Still Open : Routing Protocol Only Attack Vector: Transit Traffic Now Only Insider Attacks Possible Avoid Insider Attacks 10

6 Security Recommendations for ISPs Secure devices (, P): They are trusted (+P): Secure with ACLs on all interfaces Ideal: deny ip any <core-networks> Static - routing where possible If routing: Use authentication (MD5) Separation of - links where possible (Internet/) LDP authentication (MD5) VRF: Define maximum number of routes Note: Overall security depends on weakest link 11 Securing the P BGP Route Reflector P P Internet BGP Peering With MD5 Authentic. LDP With MD5 ACL, and Secure Routing 12

7 Feature Portfolio Traffic Forwarding (Data Plane) Signaling (Control Plane) Network Access Control Data Integrity & Privacy Service Edge Access Control Data Integrity & Privacy Network Inter-Connect Access Control Data Integrity & Privacy Native traffic separation - packet/path integrity TTL propagation IP/ packet filtering VRF-context packet forwarding - packet/path integrity Ingress packet validation (top label validation check) End-to-end cross-as packet/path integrity validation Session authentication for core signaling protocols Control plane message validation/authentication Session authentication for - signaling protocols VRF-aware control plane msg validation/auth (e.g., TTL) (max) route/prefix filtering Session authentication for inter-as signaling protocols route/prefix (RD/RT) filtering 13 Relevant Standardization IETF L3 WG: Working on Layer 3 architectures, such as IP s, IP s using virtual routers, and IPsec s. IETF L2 WG: Working on Layer 2 architectures, such as VPLS and VPWS 14

8 Conclusions security covers protection mechanisms for forwarding and signaling security requires holistic approach including network design, implementation, and operation Level of network deployment complexity determines perceived network security risks Growing importance of security as a result of network and service convergence 15 References Security ISBN RFC4381 Analysis of Security RFC2082 RIP-2 MD5 Authentication RFC2154 OSPF with Digital Signatures RFC2385 Protection of BGP Sessions via the TCP MD5 Signature Option RFC3013 Recommended Internet Service Provider Security Services and Procedures RFC2196 Site Security Handbook Gartner research note M : " Networks: Drivers Beat Inhibitors in 2003"; 10 Feb 2003 and Architectures ISBN

9 Q and A 17 18