IPv6 First Hop Security IPv6 Security im Access Layer. Stefan Portmann Netcloud AG
|
|
- Sherman Burns
- 7 years ago
- Views:
Transcription
1
2 IPv6 First Hop Security IPv6 Security im Access Layer Stefan Portmann Netcloud AG
3 Agenda Introduction The Layer 2 domain & IPv6 Neighbor Discovery (ND) / Secure Neighbor Discovery (SeND) IPv6 First-Hop Security (FHS) RA Guard IPv6 Snooping DHCP Guard Source/Prefix Guard Destination Guard FHS Config Example FHS Platform Support
4 Introduction In many modern networks, the Layer 2 domain is playing an increasingly important role, with large campuses, very large data centers, server virtualization, Layer 2 mobility, etc., all resulting in larger Layer 2 domains. This change also brings with it an increasing number of challenges, such as security and scalability. In parallel with this change, IPv6 has been gaining momentum as the next generation IP, while the IPv4 address space continues to run out. Layer 2 (and to some extent Layer 2/3) switches constitute the core of this Layer 2 domain, and their strategic position in the network provides a number of opportunities to secure this domain, and to optimize link operations. These devices are referred to as "first hops"
5 Introduction For many years, Cisco has been providing a suite of Catalyst Integrated Security Features (CISF) running on Catalyst switches, to secure and optimize Layer 2 (L2) operations for IPv4 networks. Catalyst Integrated Security Features IP Source Guard Dynamic ARP Inspection DHCP Snooping Port Security In order to provide the same level of end node protection on IPv6 or dual-stack networks, these L2 switches need to add a similar set of capabilities to address IPv6 link operations. Innocent User I m Your DHCP Server No Your Not! I m The User Server
6 Agenda Introduction The Layer 2 domain & IPv6 Neighbor Discovery (ND) / Secure Neighbor Discovery (SeND) IPv6 First-Hop Security (FHS) RA Guard IPv6 Snooping DHCP Guard Source/Prefix Guard Destination Guard FHS Config Example FHS Platform Support
7 Quick overview on the Layer 2 domain & IPv6 What is specific to IPv6 on a subnet? More addresses! More hosts allowed on the subnet (up to 2 64!). Results in much bigger subnets. More states (neighbor cache, etc) on hosts, routers and switches: creates new opportunities for DoS attacks And protocols - IPv6 link operations protocol is Neighbor Discovery More distributed and more autonomous operations Nodes discover their default router automatically Nodes auto-configure their addresses Nodes defend themselves (SeND)
8 Fundamentals On Neighbor Discovery Defined in: RFC 4861 Neighbor Discovery for IP Version 6 (IPv6) RFC 4862 IPv6 Stateless Address Auto-configuration RFC 3971 Secure Neighbor Discovery etc. Used for: Router discovery IPv6 Stateless Address Auto Configuration (SLAAC) IPv6 address resolution (replaces ARP) Neighbor Unreachability Detection (NUD) / Duplicate Address Detection (DAD) Redirection Operates above ICMPv6 Relies heavily on (link-local scope) multicast, combined with Layer 2 Multicast Works with ICMP messages and message "options"
9 Fundamentals On Neighbor Discovery
10 Secure Neighbor Discovery (SeND) Enhances NDP with additional capabilities Cryptographically Generated Addresses (CGA) IPv6 addresses whose interface identifiers are cryptographically generated RSA signature option Protect all messages relating to neighbor and router discovery Timestamp and nonce options Prevent replay attacks Certification paths for authorized Routers Anchored on trusted parties, expected to certify the authority of the routers on some prefixes
11 Secure Neighbor Discovery (SeND) To benefit fully from SeND, nodes must be provisioned with CA certificate(s) A chain of trust is "easy" to establish within the administrative boundaries, but very hard outside It is a 2 player game! And very few IPv6 stacks can play the game today: Cisco IOS, Linux and a few others
12 Agenda Introduction The Layer 2 domain & IPv6 Neighbor Discovery (ND) / Secure Neighbor Discovery (SeND) IPv6 First-Hop Security (FHS) RA Guard IPv6 Snooping DHCP Guard Source/Prefix Guard Destination Guard FHS Config Example FHS Platform Support
13 IPv6 RA Guard Router Theft Router Discovery Protocol Discover default/first hop routers Discover on-link prefixes
14 IPv6 RA Guard Rogue or malicious routers - Vulnerability #1 Attacker tricks victim into accepting itself as default router Based on rogue Router Advertisements The most frequent threat by non-malicious user Many variants: preference, timing, final RA, etc
15 IPv6 RA Guard Rogue or malicious routers - Vulnerability #2 Attacker spoofs Router Advertisement with false on-link prefix Victim generates (topology-bogus) IP address with this prefix Access router drops outgoing packets from victim (ingress filtering) Or return path is broken
16 IPv6 RA Guard RAs are used by routers to announce themselves on the link. The RA Guard blocks or rejects unwanted or rogue RA messages that arrive at the network switch platform. The RA Guard feature analyzes the RAs and filters out bogus RAs sent by unauthorized routers
17 IPv6 Snooping Address Theft - Address Resolution protocol Hosts reside on a shared "Layer 2 domain" (same link) When needed, it resolves the IP address into a MAC address Creates neighbor cache entry Maintains entry with NUD or upon receipt of any updated LLA Last Come, First Serve: good for mobility, bad for security!
18 IPv6 Snooping Address Theft - Duplicate Address Resolution Verify address uniqueness before using it Required (MUST) by SLAAC, recommended (SHOULD) by DHCP Probe neighbors to verify nobody claims the address
19 IPv6 Snooping Address Theft Vulnerability #1 Attacker can claim victim's IP address
20 IPv6 Snooping Address Theft Vulnerability #2 Attacker hacks any victim's DAD attempts Victim can't configure IP address and can't communicate
21 IPv6 Snooping A database table of IPv6 neighbors connected to the switch is created from multiple sources of information. For example, ND traffic, DHCP traffic and Data traffic. This binding table is used by ND Inspection (to validate the link-layer address (LLA)), perport address limit Device tracking (to prefix binding of the neighbors to prevent spoofing and redirect attacks)
22 IPv6 DHCP Guard The DHCP Guard can be used to prevent forged messages from being entered in the binding table. The DHCP Guard blocks DHCP server messages when they are received on ports that are not explicitly configured as facing a DHCP server or DHCP relay
23 IPv6 Source/Prefix Guard The IPv6 Source Guard provides the ability to use the IPv6 binding table to install Port-ACLs to prevent a host from sending packets with an invalid IPv6 source address. Source addresses listed in the binding table are permitted on the switch port, other traffic will be blocked
24 IPv6 Destination Guard The Destination Guard helps in minimizing denial-of-service (DoS) attacks. It performs address resolutions, based on the binding table, only for those addresses that are active on the link. This feature enables the filtering of IPv6 traffic based on the destination address, and blocks the NDP resolution for destination addresses that are not found in the binding table
25 Agenda Introduction The Layer 2 domain & IPv6 Neighbor Discovery (ND) / Secure Neighbor Discovery (SeND) IPv6 First-Hop Security (FHS) RA Guard IPv6 Snooping DHCP Guard Source/Prefix Guard Destination Guard FHS Config Example FHS Platform Support
26 FHS Config Example ipv6 snooping policy POLICY-SNOOPING ipv6 nd raguard policy POLICY-RAGUARD-HOST device-role host ipv6 nd raguard policy POLICY-RAGUARD-ROUTER device-role router ipv6 dhcp guard policy POLICY-DHCPGUARD-CLIENT device-role client ipv6 dhcp guard policy POLICY-DHCPGUARD-SERVER device-role server match reply prefix-list PREFIX-LIST-DHCP-SERVER-RANGE ipv6 prefix-list PREFIX-LIST-DHCP-SERVER-RANGE seq 5 permit 2001:DB8:1234::/
27 FHS Config Example vlan configuration 100 ipv6 nd raguard attach-policy POLICY-RAGUARD-HOST ipv6 dhcp guard attach-policy POLICY-DHCPGUARD-CLIENT ipv6 snooping attach-policy POLICY-SNOOPING interface GigabitEthernet0/1 description *** Uplink Port *** ipv6 nd raguard attach-policy POLICY-RAGUARD-ROUTER ipv6 dhcp guard attach-policy POLICY-DHCPGUARD-SERVER end interface GigabitEthernet0/2 description *** Access Port *** switchport access vlan
28 IPv6 First Hop Security Platform Support
29 Konnten wir Ihre Fragen beantworten?! Herzlichen Dank!
IPv6 First Hop Security Protecting Your IPv6 Access Network
IPv6 First Hop Security Protecting Your IPv6 Access Network What You Will Learn This paper provides a brief introduction to common security threats on IPv6 campus access networks and will explain the value
More informationIPv6 Secure Neighbor Discovery
IPv6 Secure Neighbor Discovery Andreas Hunkeler January 2015 Compass Security Schweiz AG Werkstrasse 20 Postfach 2038 CH-8645 Jona Tel +41 55 214 41 60 Fax +41 55 214 41 61 team@csnc.ch www.csnc.ch IPv6
More informationIPv6 Associated Protocols
IPv6 Associated Protocols 1 New Protocols (1) New features are specified in IPv6 Protocol -RFC 2460 DS Neighbor Discovery (NDP) -RFC 4861 DS Auto-configuration : Stateless Address Auto-configuration -RFC
More informationIPv6 Infrastructure Security
IPv6 Infrastructure Security 2013 North American IPv6 Summit Jeffrey L Carrell Network Conversions Network Security Consultant IPv6 SME/Trainer 1 Agenda IPv6 address fundamentals Operating Systems support
More informationSEcure Neighbour Discovery: A Report
SEcure Neighbour Discovery: A Report Arun Raghavan (Y6111006) CS625: Advanced Computer Networks Abstract The IPv6 [5] Neighbour Discovery [12] protocol is used by nodes in IPv6 for such purposes as discover
More informationSecurity Assessment of Neighbor Discovery for IPv6
Security Assessment of Neighbor Discovery for IPv6 Fernando Gont project carried out on behalf of UK Centre for the Protection of National Infrastructure LACNIC XV 15 al 20 de Mayo de 2011. Cancún, México
More informationThreats and Security Analysis for Enhanced Secure Neighbor Discovery Protocol (SEND) of IPv6 NDP Security
Threats and Security Analysis for Enhanced Secure Neighbor Discovery Protocol (SEND) of IPv6 NDP Security Yvette E. Gelogo 1, Ronnie D. Caytiles 1 and Byungjoo Park 1 * 1Multimedia Engineering Department,
More informationVulnerabili3es and A7acks
IPv6 Security Vulnerabili3es and A7acks Inherent vulnerabili3es Less experience working with IPv6 New protocol stack implementa3ons Security devices such as Firewalls and IDSs have less support for IPv6
More informationIPv6 INFRASTRUCTURE SECURITY WORKSHOP SESSION 10 BUILDING IPv6 INFRASTRUCTURE NETWORK SECURITY
IPv6 INFRASTRUCTURE SECURITY WORKSHOP SESSION 10 BUILDING IPv6 INFRASTRUCTURE NETWORK SECURITY Alastair JOHNSON July 2013 INTRODUCTION This module will cover network infrastructure security relating to:
More informationIP(v6) security. Matěj Grégr. Brno University of Technology, Faculty of Information Technology. Slides adapted from Ing.
IP(v6) security Matěj Grégr Brno University of Technology, Faculty of Information Technology Slides adapted from Ing. Tomáš Podermański What is IP security? Encryption? Authentication? Authorization? Surveillance?
More informationSecurity of IPv6 and DNSSEC for penetration testers
Security of IPv6 and DNSSEC for penetration testers Vesselin Hadjitodorov Master education System and Network Engineering June 30, 2011 Agenda Introduction DNSSEC security IPv6 security Conclusion Questions
More informationIPv6 Infrastructure Security
TXv6TF 2013 Summit IPv6 Infrastructure Security Jeffrey L Carrell Network Conversions Network Security Consultant IPv6 SME/Trainer 1 Agenda IPv6 address fundamentals Operating Systems support ICMPv6 -
More informationIPv6 Infrastructure Security Jeffrey L Carrell Network Conversions Network Security Consultant, IPv6 SME/Trainer
IPv6 Infrastructure Security Jeffrey L Carrell Network Conversions Network Security Consultant, IPv6 SME/Trainer 1 IPv6 Infrastructure Security v1.1 - Copyright 2013 Jeffrey L. Carrell Agenda IPv6 address
More informationIPv6 SECURITY. May 2011. The Government of the Hong Kong Special Administrative Region
IPv6 SECURITY May 2011 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole or in part without the express
More informationIPv6 Diagnostic and Troubleshooting
8 IPv6 Diagnostic and Troubleshooting Contents Introduction.................................................. 8-2 ICMP Rate-Limiting........................................... 8-2 Ping for IPv6 (Ping6)..........................................
More informationExploiting First Hop Protocols to Own the Network. Rocket City TakeDownCon 2015. Paul Coggin Senior Principal Cyber Security Analyst @PaulCoggin
Exploiting First Hop Protocols to Own the Network Rocket City TakeDownCon 2015 Paul Coggin Senior Principal Cyber Security Analyst @PaulCoggin www.dynetics.com V## Goes Here 1 OSI and TCP/IP Model OSI
More informationNeighbour Discovery in IPv6
Neighbour Discovery in IPv6 Andrew Hines Topic No: 17 Email: hines@zitmail.uni-paderborn.de Organiser: Christian Schindelhauer University of Paderborn Immatriculation No: 6225220 August 4, 2004 1 Abstract
More informationIPv6 Security Analysis
CENTER FOR CONVERGENCE AND EMERGING NETWORK TECHNOLOGIES CCENT School of Information Studies Syracuse University IPv6 Security Analysis TECHNICAL REPORT: T.R. 2014-002 Authored by: Jose Gonzalo Bejar (revised
More informationIPv6 Security. Scott Hogg, CCIE No. 5133 Eric Vyncke. Cisco Press. Cisco Press 800 East 96th Street Indianapolis, IN 46240 USA
IPv6 Security Scott Hogg, CCIE No. 5133 Eric Vyncke Cisco Press Cisco Press 800 East 96th Street Indianapolis, IN 46240 USA Contents Introduction xix Chapter 1 Introduction to IPv6 Security 3 Reintroduction
More informationIPv6 Security Best Practices. Eric Vyncke evyncke@cisco.com Distinguished System Engineer
IPv6 Best Practices Eric Vyncke evyncke@cisco.com Distinguished System Engineer security 2007 Cisco Systems, Inc. All rights reserved. Cisco CPub 1 Agenda Shared Issues by IPv4 and IPv6 Specific Issues
More informationSecurity Technology White Paper
Security Technology White Paper Issue 01 Date 2012-10-30 HUAWEI TECHNOLOGIES CO., LTD. 2012. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without
More informationOLD VULNERABILITIES IN NEW PROTOCOLS? HEADACHES ABOUT IPV6 FRAGMENTS
OLD VULNERABILITIES IN NEW PROTOCOLS? HEADACHES ABOUT IPV6 FRAGMENTS Eric Vyncke (@evyncke) Cisco Session ID: ARCH W01 Session Classification: Advanced Agenda Status of WorldWide IPv6 Deployment IPv6 refresher:
More informationSecurity Considerations in IP Telephony Network Configuration
Security Considerations in IP Telephony Network Configuration Abstract This Technical Report deals with fundamental security settings in networks to provide secure VoIP services. Example configurations
More informationConfiguring DHCP Snooping
CHAPTER 19 This chapter describes how to configure Dynamic Host Configuration Protocol (DHCP) snooping on Catalyst 4500 series switches. It provides guidelines, procedures, and configuration examples.
More informationIPv6 Hardening Guide for Windows Servers
IPv6 Hardening Guide for Windows Servers How to Securely Configure Windows Servers to Prevent IPv6-related Attacks Version: 1.0 Date: 22/12/2014 Classification: Public Author(s): Antonios Atlasis TABLE
More informationGuide to Network Defense and Countermeasures Third Edition. Chapter 2 TCP/IP
Guide to Network Defense and Countermeasures Third Edition Chapter 2 TCP/IP Objectives Explain the fundamentals of TCP/IP networking Describe IPv4 packet structure and explain packet fragmentation Describe
More informationIPv6 Security. Scott Hogg. Global Technology Resources, Inc. Director of Technology Solutions CCIE #5133, CISSP #4610
IPv6 Security Scott Hogg Global Technology Resources, Inc. Director of Technology Solutions CCIE #5133, CISSP #4610 IPv6 Security Latent Threat Even if you haven t started using IPv6 yet, you probably
More informationSecuring IPv6. What Students Will Learn:
Securing IPv6 When it comes to IPv6, one of the more contentious issues is IT security. Uninformed analysts, anit-v6 pundits, and security ne're-do-wells have created a mythos that IPv6 is inherently less
More informationHow To Understand and Configure Your Network for IntraVUE
How To Understand and Configure Your Network for IntraVUE Summary This document attempts to standardize the methods used to configure Intrauve in situations where there is little or no understanding of
More informationCCNA R&S: Introduction to Networks. Chapter 5: Ethernet
CCNA R&S: Introduction to Networks Chapter 5: Ethernet 5.0.1.1 Introduction The OSI physical layer provides the means to transport the bits that make up a data link layer frame across the network media.
More informationLocal Area Networks. LAN Security and local attacks. TDC 363 Winter 2008 John Kristoff - DePaul University 1
Local Area Networks LAN Security and local attacks TDC 363 Winter 2008 John Kristoff - DePaul University 1 Overview Local network attacks target an internal network Some attacks can be launched remotely
More informationIP Routing Features. Contents
7 IP Routing Features Contents Overview of IP Routing.......................................... 7-3 IP Interfaces................................................ 7-3 IP Tables and Caches........................................
More information100-101: Interconnecting Cisco Networking Devices Part 1 v2.0 (ICND1)
100-101: Interconnecting Cisco Networking Devices Part 1 v2.0 (ICND1) Course Overview This course provides students with the knowledge and skills to implement and support a small switched and routed network.
More informationProcedure: You can find the problem sheet on Drive D: of the lab PCs. 1. IP address for this host computer 2. Subnet mask 3. Default gateway address
Objectives University of Jordan Faculty of Engineering & Technology Computer Engineering Department Computer Networks Laboratory 907528 Lab.4 Basic Network Operation and Troubleshooting 1. To become familiar
More informationWhat is VLAN Routing?
Application Note #38 February 2004 What is VLAN Routing? This Application Notes relates to the following Dell product(s): 6024 and 6024F 33xx Abstract Virtual LANs (VLANs) offer a method of dividing one
More informationIPv6 Trace Analysis using Wireshark Nalini Elkins, CEO Inside Products, Inc. Nalini.elkins@insidethestack.com
1 IPv6 Trace Analysis using Wireshark Nalini Elkins, CEO Inside Products, Inc. Nalini.elkins@insidethestack.com Agenda What has not changed between IPv4 and IPv6 traces What has changed between IPv4 and
More informationMobility on IPv6 Networks
Mobility on IPv6 Networks Pedro M. Ruiz Project Manager Agora Systems S.A. Global IPv6 Summit Madrid 13-15 March 2002 Pedro M. Ruiz (c) Agora Systems S.A, 2002 1 Outline Motivation MIPv6 architecture MIPv6
More informationTomás P. de Miguel DIT-UPM. dit UPM
Tomás P. de Miguel DIT- 15 12 Internet Mobile Market Phone.com 15 12 in Millions 9 6 3 9 6 3 0 1996 1997 1998 1999 2000 2001 0 Wireless Internet E-mail subscribers 2 (January 2001) Mobility The ability
More information3.5 IPv6 Forum Certified Security Course, Engineer, Trainer & Certification (GOLD)
3.5 IPv6 Forum Certified Security Course, Engineer, Trainer & Certification (GOLD) The IPv6 Forum Certified Security Program (Security Course, Security Engineer, Security Trainer and Security Degree Exams
More informationThe Myth of Twelve More Bytes. Security on the Post- Scarcity Internet
The Myth of Twelve More Bytes Security on the Post- Scarcity Internet IPv6 The Myth of 12 More Bytes HTTP DHCP HTTP TLS ARP TCP UDP Internet Protocol Link Layer Physical Layer ICMP The Myth of 12 More
More informationNetwork Security. Topology. Spring 2014. This is the logical topology of the network environment used for testing.
Course: 1DV447 Advanced LAN Technologies Network Security Spring 2014 Topology This is the logical topology of the network environment used for testing. 1/ Introduction The area i want to focus on is network
More informationFirewalls und IPv6 worauf Sie achten müssen!
Firewalls und IPv6 worauf Sie achten müssen! Pascal Raemy CTO Asecus AG pascal.raemy@asecus.ch Asecus AG Asecus AG Security (Firewall, Web-Gateway, Mail-Gateway) Application Delivery (F5 Neworks with BIGIP)
More information19531 - Telematics. 9th Tutorial - IP Model, IPv6, Routing
19531 - Telematics 9th Tutorial - IP Model, IPv6, Routing Bastian Blywis Department of Mathematics and Computer Science Institute of Computer Science 06. January, 2011 Institute of Computer Science Telematics
More informationEric Vyncke, Distinguished Engineer, evyncke@cisco.com. 2011 Cisco and/or its affiliates. All rights reserved. Cisco Public 1
Eric Vyncke, Distinguished Engineer, evyncke@cisco.com 2011 Cisco and/or its affiliates. All rights reserved. Cisco Public 1 Sometimes, newer means better and more secure Sometimes, experience IS better
More informationRecent advances in IPv6 insecurities Marc van Hauser Heuse Deepsec 2010, Vienna. 2010 Marc Heuse <mh@mh-sec.de>
Recent advances in IPv6 insecurities Marc van Hauser Heuse Deepsec 2010, Vienna 2010 Marc Heuse Hello, my name is The future is here already Let s start with the basics IPv4 4 octets 4.294.967.296
More informationCloudEngine Series Switches. IPv6 Technical White Paper. Issue 01 Date 2014-02-19 HUAWEI TECHNOLOGIES CO., LTD.
Issue 01 Date 2014-02-19 HUAWEI TECHNOLOGIES CO., LTD. 2014. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of
More informationCisco IOS Flexible NetFlow Technology
Cisco IOS Flexible NetFlow Technology Last Updated: December 2008 The Challenge: The ability to characterize IP traffic and understand the origin, the traffic destination, the time of day, the application
More informationDedication Preface 1. The Age of IPv6 1.1 INTRODUCTION 1.2 PROTOCOL STACK 1.3 CONCLUSIONS 2. Protocol Architecture 2.1 INTRODUCTION 2.
Dedication Preface 1. The Age of IPv6 1.1 INTRODUCTION 1.2 PROTOCOL STACK 1.3 CONCLUSIONS 2. Protocol Architecture 2.1 INTRODUCTION 2.2 COMPARISONS OF IP HEADER FORMATS 2.3 EXTENSION HEADERS 2.3.1 Options
More informationCourse Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network.
Course Name: TCP/IP Networking Course Overview: Learn the essential skills needed to set up, configure, support, and troubleshoot your TCP/IP-based network. TCP/IP is the globally accepted group of protocols
More informationEric Vyncke, Distinguished Engineer, evyncke@cisco.com. 2011 Cisco and/or its affiliates. All rights reserved. Cisco Public 1
Eric Vyncke, Distinguished Engineer, evyncke@cisco.com 2011 Cisco and/or its affiliates. All rights reserved. Cisco Public 1 2011 Cisco and/or its affiliates. All rights reserved. Cisco Public 2 Sometimes,
More informationCIRA s experience in deploying IPv6
CIRA s experience in deploying IPv6 Canadian Internet Registration Authority (CIRA) Jacques Latour Director, Information Technology Ottawa, April 29, 2011 1 About CIRA The Registry that operates the Country
More informationImplementing DHCPv6 on an IPv6 network
Implementing DHCPv6 on an IPv6 network Benjamin Long benlong@iol.unh.edu 8-11-2009 Implementing DHCPv6 on an IPv6 network 2 Table of Contents DHCPv6 Overview...3 Terms used by DHCPv6...3 DHCPv6 Message
More informationIPv6 Functionality. Jeff Doyle IPv6 Solutions Manager jeff@juniper.net
IPv6 Functionality Jeff Doyle IPv6 Solutions Manager jeff@juniper.net Copyright 2003 Juniper Networks, Inc. Agenda ICMPv6 Neighbor discovery Autoconfiguration Agenda ICMPv6 Neighbor discovery Autoconfiguration
More informationProCurve Networking IPv6 The Next Generation of Networking
ProCurve Networking The Next Generation of Networking Introduction... 2 Benefits from... 2 The Protocol... 3 Technology Features and Benefits... 4 Larger number of addresses... 4 End-to-end connectivity...
More informationHP 5120 SI Switch Series
HP 5120 SI Switch Series Layer 3 - IP Services Command Reference Part number: 5998-1810 Software version: Release 1505 Document version: 6W102-20121111 Legal and notice information Copyright 2012 Hewlett-Packard
More informationInterconnecting Cisco Network Devices 1 Course, Class Outline
www.etidaho.com (208) 327-0768 Interconnecting Cisco Network Devices 1 Course, Class Outline 5 Days Interconnecting Cisco Networking Devices, Part 1 (ICND1) v2.0 is a five-day, instructorled training course
More informationPresentation_ID. 2001, Cisco Systems, Inc. All rights reserved.
Presentation_ID 2001, Cisco Systems, Inc. All rights reserved. 1 IPv6 Security Considerations Patrick Grossetete pgrosset@cisco.com Dennis Vogel dvogel@cisco.com 2 Agenda Native security in IPv6 IPv6 challenges
More informationFirewall Stateful Inspection of ICMP
The feature categorizes Internet Control Management Protocol Version 4 (ICMPv4) messages as either malicious or benign. The firewall uses stateful inspection to trust benign ICMPv4 messages that are generated
More informationINLICHTINGEN DIENSTEN INLICHTINGEN DIENSTEN
Indien u hergebruik wenst te maken van de inhoud van deze presentatie, vragen wij u in het kader van auteursrechtelijke bescherming de juiste bronvermelding toe te passen. 17 juni 2014 De Reehorst in Ede
More informationPacket Sniffing on Layer 2 Switched Local Area Networks
Packet Sniffing on Layer 2 Switched Local Area Networks Ryan Spangler ryan@packetwatch.net Packetwatch Research http://www.packetwatch.net December 2003 Abstract Packet sniffing is a technique of monitoring
More informationSecuring end devices
Securing end devices Securing the network edge is already covered. Infrastructure devices in the LAN Workstations Servers IP phones Access points Storage area networking (SAN) devices. Endpoint Security
More informationIPv6 Security Assessment and Benchmarking Abstract Test Suite
IPv6 Security Assessment and Benchmarking Abstract Test Suite Version 1.0 2013-01-22 EANTC AG Copyright (C) 2012, 2013 EANTC European Advanced Networking Test Center Aktiengesellschaft This document is
More informationConfiguring the Transparent or Routed Firewall
5 CHAPTER This chapter describes how to set the firewall mode to routed or transparent, as well as how the firewall works in each firewall mode. This chapter also includes information about customizing
More informationIPv6 Security - Opportunities and Challenges
IPv6 Security - Opportunities and Challenges Thomas Scheffler Beuth Hochschule Berlin, Germany {scheffler@beuth-hochschule.de} The Basics Agenda 1 The Basics IPv6 Network Security ICMPv6 / Autoconfiguration
More informationIPv6 Security from point of view firewalls
IPv6 Security from point of view firewalls János Mohácsi 09/June/2004 János Mohácsi, Research Associate, Network Engineer NIIF/HUNGARNET Contents Requirements IPv6 firewall architectures Firewalls and
More informationProtecting and controlling Virtual LANs by Linux router-firewall
Protecting and controlling Virtual LANs by Linux router-firewall Tihomir Katić Mile Šikić Krešimir Šikić Faculty of Electrical Engineering and Computing University of Zagreb Unska 3, HR 10000 Zagreb, Croatia
More informationConfiguring Flexible NetFlow
CHAPTER 62 Note Flexible NetFlow is only supported on Supervisor Engine 7-E, Supervisor Engine 7L-E, and Catalyst 4500X. Flow is defined as a unique set of key fields attributes, which might include fields
More informationIPv6 Fundamentals: A Straightforward Approach
IPv6 Fundamentals: A Straightforward Approach to Understanding IPv6 Rick Graziani Cisco Press 800 East 96th Street Indianapolis, IN 46240 IPv6 Fundamentals Contents Introduction xvi Part I: Background
More informationThe Design of the Network Service Access Control System through Address Control in IPv6 Environments
174 IJCSNS International Journal of Computer Science and Network Security, VOL.6 No.6, June 2006 The Design of the Network Service Access Control System through Address Control in IPv6 Environments Summary
More informationCCNA Exploration: Accessing the WAN Chapter 7 Case Study
Objectives: Mitigate attacks based on DHCP rogue servers. Intro: ChurchBells Inc. is having connectivity issues and needs your help. The Scenario: According to the reports, some user PCs within the company
More informationA host-based firewall can be used in addition to a network-based firewall to provide multiple layers of protection.
A firewall is a software- or hardware-based network security system that allows or denies network traffic according to a set of rules. Firewalls can be categorized by their location on the network: A network-based
More informationStrategies to Protect Against Distributed Denial of Service (DD
Strategies to Protect Against Distributed Denial of Service (DD Table of Contents Strategies to Protect Against Distributed Denial of Service (DDoS) Attacks...1 Introduction...1 Understanding the Basics
More informationMoonv6 Test Suite. IPv6 Firewall Functionality and Interoperablility Test Suite. Technical Document. Revision 0.6
Moonv6 Test Suite IPv6 Firewall Functionality and Interoperablility Test Suite Technical Document Revision 0.6 IPv6 Consortium 121 Technology Drive, Suite 2 InterOperability Laboratory Durham, NH 03824-3525
More informationInternet Control Protocols Reading: Chapter 3
Internet Control Protocols Reading: Chapter 3 ARP - RFC 826, STD 37 DHCP - RFC 2131 ICMP - RFC 0792, STD 05 1 Goals of Today s Lecture Bootstrapping an end host Learning its own configuration parameters
More informationPractical IPv6 Monitoring on Campus
Practical IPv6 Monitoring on Campus Best Practice Document Produced by the CESNET-led Working Group on Network Monitoring (CESNET BPD 132) Authors: Matěj Grégr, Petr Matoušek, Tomáš Podermański, Miroslav
More informationMitigation of Breaking Connections. (a.k.a. OLSRd v1 Multi-Gateway & BRDP)
Mitigation of Breaking Connections (a.k.a. OLSRd v1 Multi-Gateway & BRDP) About Me Ferry Huberts Self-Employed Open Source Entrepreneur Lead Committer for OLSRd v1 Committer in several other projects Mainly
More informationCCT vs. CCENT Skill Set Comparison
Operation of IP Data Networks Recognize the purpose and functions of various network devices such as Routers, Switches, Bridges and Hubs Select the components required to meet a given network specification
More informationGB-OS Version 6.2. Configuring IPv6. Tel: +1.407.380.0220 Fax. +1.407.380.6080 Email: info@gta.com Web: www.gta.com
GB-OS Version 6.2 Configuring IPv6 IPv6201411-01 Global Technology Associates 3505 Lake Lynda Drive Suite 115 Orlando, FL 32817 Tel: +1.407.380.0220 Fax. +1.407.380.6080 Email: info@gta.com Web: www.gta.com
More informationIPv6 End Station Addressing: Choosing SLAAC or DHCP Jeff Harrington - NYSERNet
IPv6 End Station Addressing: Choosing SLAAC or DHCP Jeff Harrington - NYSERNet 1 Important Planning Decisions Planning for IPv6 on Campus Three major areas need to be addressed during planning. There are
More informationCconducted at the Cisco facility and Miercom lab. Specific areas examined
Lab Testing Summary Report July 2009 Report 090708 Product Category: Unified Communications Vendor Tested: Key findings and conclusions: Cisco Unified Communications solution uses multilayered security
More informationACADEMIA LOCAL CISCO UCV-MARACAY CONTENIDO DE CURSO CURRICULUM CCNA. SEGURIDAD SEGURIDAD EN REDES. NIVEL I. VERSION 2.0
ACADEMIA LOCAL CISCO UCV-MARACAY CONTENIDO DE CURSO CURRICULUM CCNA. SEGURIDAD SEGURIDAD EN REDES. NIVEL I. VERSION 2.0 Module 1: Vulnerabilities, Threats, and Attacks 1.1 Introduction to Network Security
More information- Basic Router Security -
1 Enable Passwords - Basic Router Security - The enable password protects a router s Privileged mode. This password can be set or changed from Global Configuration mode: Router(config)# enable password
More informationITL BULLETIN FOR JANUARY 2011
ITL BULLETIN FOR JANUARY 2011 INTERNET PROTOCOL VERSION 6 (IPv6): NIST GUIDELINES HELP ORGANIZATIONS MANAGE THE SECURE DEPLOYMENT OF THE NEW NETWORK PROTOCOL Shirley Radack, Editor Computer Security Division
More informationInterconnecting Cisco Networking Devices, Part 1 (ICND1) v3.0
Interconnecting Cisco Networking Devices, Part 1 (ICND1) v3.0 COURSE OVERVIEW: Interconnecting Cisco Networking Devices, Part 1 (ICND1) v3.0 is a five-day, instructor-led training course that teaches learners
More informationBASIC ANALYSIS OF TCP/IP NETWORKS
BASIC ANALYSIS OF TCP/IP NETWORKS INTRODUCTION Communication analysis provides powerful tool for maintenance, performance monitoring, attack detection, and problems fixing in computer networks. Today networks
More informationTop-Down Network Design
Top-Down Network Design Chapter Five Designing a Network Topology Copyright 2010 Cisco Press & Priscilla Oppenheimer Topology A map of an internetwork that indicates network segments, interconnection points,
More informationΕΠΛ 674: Εργαστήριο 5 Firewalls
ΕΠΛ 674: Εργαστήριο 5 Firewalls Παύλος Αντωνίου Εαρινό Εξάμηνο 2011 Department of Computer Science Firewalls A firewall is hardware, software, or a combination of both that is used to prevent unauthorized
More informationIPv6 Security 111 Short Module on Security
IPv6 Security 111 Short Module on Security IPv6 Security 1 Copy Rights This slide set is the ownership of the 6DEPLOY project via its partners The Powerpoint version of this material may be reused and
More informationBuilding Secure Network Infrastructure For LANs
Building Secure Network Infrastructure For LANs Yeung, K., Hau; and Leung, T., Chuen Abstract This paper discusses the building of secure network infrastructure for local area networks. It first gives
More informationConfigure IOS Catalyst Switches to Connect Cisco IP Phones Configuration Example
Configure IOS Catalyst Switches to Connect Cisco IP Phones Configuration Example Document ID: 69632 Introduction Prerequisites Requirements Components Used Conventions Background Information Configure
More informationNetwork Security. Ensuring Information Availability. Security
Ensuring Information Availability Security - Ensuring Information Availability Introduction The advent of the Internet and the huge array of connected devices has led to an insatiable demand for access
More informationAttack Lab: Attacks on TCP/IP Protocols
Laboratory for Computer Security Education 1 Attack Lab: Attacks on TCP/IP Protocols Copyright c 2006-2010 Wenliang Du, Syracuse University. The development of this document is funded by the National Science
More informationDMZ Virtualization Using VMware vsphere 4 and the Cisco Nexus 1000V Virtual Switch
DMZ Virtualization Using VMware vsphere 4 and the Cisco Nexus 1000V Virtual Switch What You Will Learn A demilitarized zone (DMZ) is a separate network located in the neutral zone between a private (inside)
More informationFrequent Denial of Service Attacks
Frequent Denial of Service Attacks Aditya Vutukuri Science Department University of Auckland E-mail:avut001@ec.auckland.ac.nz Abstract Denial of Service is a well known term in network security world as
More informationCMPT 471 Networking II
CMPT 471 Networking II Firewalls Janice Regan, 2006-2013 1 Security When is a computer secure When the data and software on the computer are available on demand only to those people who should have access
More informationIPV6 DEPLOYMENT GUIDELINES FOR. ARRIS Group, Inc.
IPV6 DEPLOYMENT GUIDELINES FOR CABLE OPERATORS Patricio i S. Latini i ARRIS Group, Inc. Current IPv4 Situationti IANA has already assigned the last IPv4 Blocks to the RIRs. RIRs address exhaustion may
More informationHow To Compare Ipv6 And Ipv4 To Ipv5 (V1.2.0)
IPv6 and IPv4 Threat Comparison and Best- Practice Evaluation (v1.0) Sean Convery (sean@cisco.com) Darrin Miller (dmiller@cisco.com) Table of Contents 1 Introduction...2 1.1 Caveats...3 2 Overview of IPv4
More informationWhat communication protocols are used to discover Tesira servers on a network?
Understanding device discovery methods in Tesira OBJECTIVES In this application note, basic networking concepts will be summarized to better understand how Tesira servers are discovered over networks.
More informationPersonal Firewall Default Rules and Components
Personal Firewall Default Rules and Components The Barracuda Personal Firewall comes with a default access ruleset. The following tables aim to give you a compact overview of the default rules and their
More informationHow to securely operate an IPv6 network
How to securely operate an IPv6 network https://tools.ietf.org/html/draft-ietf-opsec-v6-06 LACNIC 23 Enrique Davila enriqued@cisco.com Released: May 2015 Agenda Ø Management Plane Ø Control Plane Routing
More information