As was stated in the introduction, the communications architecture of all switches and routers is segmented into three different planes which are vulnerable to security attacks. Understanding not only how to secure these planes, but to troubleshoot and resolve potential problems based on implemented solutions is a core requirement of any network engineer. The communications architecture planes of network devices are:
- The Management Plane
- The Control Plane
- The Forwarding Plane
The Management Plane
The management plane is responsible for management functions. The management plane is used to manage a device through its connection to the network. This plane also coordinates functions among all other the planes, i.e. the management, control, and the data plane. Management protocols, such as SNMP, Telnet, HTTP, HTTPS and SSH are used for device monitoring and CLI access at the management plane. In addition to management protocols, console access, i.e. via the Console port, is also used to manage devices. Some security considerations for the management plane include the following:
- Secure access to the device console: Use logins and passwords to ensure that the console is secured and no unauthorized parties are able to gain access to the device. Consider using security authentication protocols such as RADIUS and TACACS+ to centralize the console authentication process. In addition to passwords and security protocols, physical security should also be taken into consideration ensuring that only authorized personnel can gain physical access to the device(s)
- Avoid using management protocols such as Telnet which send the username/password information in clear text. Instead, consider using SSH to remotely access and manage network device. In addition to this, also consider using IP ACLs to restrict the range of addresses or networks that can gain remote access to the device(s)
- Consider implementing only the management protocols that are required. For example, if HTTP will not be used, disable this service and enable HTTPS access only. When implementing monitoring, e.g. via SNMP, consider using SNMPv1 and v2c for read-only access to devices, while using SNMPv3, which offers greater security than versions 1 and 2c, for read-write access to the device(s)
- Disable the password-recovery service using the no service password-recovery global configuration command. This prevents anyone with console access from insecurely accessing the device configuration and clearing the password. It also prevents malicious users from changing the configuration register value and access NVRAM
- Disable any unused services that can be used to launch Denial of Service (DoS) attacks. These services include TCP and UDP small services, which include Echo (port number 7), Discard (port number 9), Daytime (port number 13), and Chargen (port number 19). By default, these services are disabled in Cisco IOS 12.0 and later. Another service which should be disabled is the finger service. This service provides information on who is logged into the system and provides extensive user information, which is extremely valuable for hacking. By default, finger is disabled in Cisco IOS 12.1 and later. Additional services that should be disabled if not used include HTTP and HTTP, CDP and the configuration service which allows a Cisco IOS device to attempt to locate a configuration file on the network using TFTP. This is disabled using the no service config global configuration command
- Also consider reducing the EXEC timeout, which specifies the interval that the EXEC command interpreter waits for user input before it terminates a session. By default, sessions are disconnected after 10 minutes of inactivity; however, this can be modified using the exec-timeout line configuration command
- And finally, enable logging, preferably to a central location. Logging provides you visibility into the operation of a device and the network into which it is deployed
The Control Plane
A control plane is a collection of processes that run at the process level on a route processor and collectively provide high-level control for most Cisco IOS software functions. All traffic directly or indirectly destined to a router or switch is handled by the control plane. Control plane protocols include routing protocols, such as EIGRP and OSPF, as well as Layer 2 protocols such as Spanning Tree Protocol (STP).
For the most part, most control plane protocols, e.g. EIGRP, OSPF, HSRP have their own inbuilt security and authentication schemes. For example, all three protocols mentioned support MD5 hashing as a means to protect protocol messages. For protocols such as Spanning Tree Protocol, consider integrating Cisco IOS enhancements, such as Root Guard and BPDU Guard.
The BPDU Guard feature is used to protect the Spanning Tree domain from external influence by preventing false information from being injected into the Spanning Tree domain on ports that have Spanning Tree disabled. BPDU Guard is disabled by default but is recommended for all ports on which the Port Fast feature has been enabled. When a port that is configured with the BPDU Guard feature receives a BPDU, it immediately transitions to the errdisable state.
On the other hand, the Root Guard feature prevents a Designated Port from becoming a Root Port. If a port on which the Root Guard feature receives a superior BPDU, it moves the port into a root-inconsistent state, thus maintaining the current Root Bridge status quo. Both BPDU Guard and Root Guard are described in greater detail in the SWITCH guide available online.
At the control plane, additional features such as Dynamic ARP Inspection and DHCP Snooping can be used to protocol against vulnerabilities in protocols such as ARP and DHCP respectively. Dynamic ARP Inspection (DAI) is used to protect against ARP spoofing attacks, while DHCP Snooping is used to protect against DHCP spoofing and starvation attacks. DHCP starvation attacks work using MAC address spoofing and entail flooding a large number of DHCP requests with randomly generated spoofed MAC addresses to the target DHCP server, thereby exhausting the address space available for a period of time. This prevents legitimate DHCP clients from being serviced by the DHCP server.
Cisco IOS software also supports Control Plane Policing (CoPP) and Control Plane Protocol (CPP) which allow administrators to further secure the control plane. Control Plane Policing allows administrator to configure a Quality of Service (QoS) filter that manages the traffic flow of control plane packets to protect the control plane of Cisco IOS routers and switches against reconnaissance and Denial of Service (DoS) attacks. Implementing this feature allows the control plane to maintain packet forwarding and protocol states despite an attack or heavy traffic load on the router or switch.
Control Plane Protection (CPP) extends on CoPP by providing additional granularity. Control Plane Protection allows for the classification of the control plane traffic based on packet destination and information provided by the forwarding plane, allowing appropriate throttling for each category of packet. Unlike CoPP, CPP is dependent on CEF for IP packet redirection. The configuration of CoPP and CPP is beyond the scope of the current TSHOOT exam. Some additional security considerations for the control plane include the following:
- Disable ICMP redirects using the no ip redirects interface configuration command. ICMP redirects. There are two types of ICMP redirect messages: redirect for a host address and redirect for an entire subnet. A malicious user can exploit the ability of the router to send ICMP redirects by continually sending packets to the router, forcing the router to respond with ICMP redirect messages, resulting in an adverse impact on the CPU and performance of the router
- Unless absolutely required, disable ICMP unreachables. ICMP destination unreachable messages are generated by a router to inform the source host that the destination Unicast address is unreachable. While typically a good thing, generating a lot of these messages can increase the CPU utilization on a device and facilitate DoS attacks. ICMP unreachables are disabled using the no ip unreachables interface configuration command in Cisco IOS software
- Another control plane service that should be disabled unless absolutely needed is Proxy ARP. Proxy ARP allows the router to answer ARP requests intended for another machine. In most networks, this is a good thing because it negates the need for hosts to have a default gateway or routing intelligence. However, from a security perspective, Proxy ARP can allow attackers to spoof or pretend to be another machine, facilitating Man-In-The-Middle (MITM) attacks. Additionally, using proxy ARP can result in an increase in the amount of ARP traffic on the network segment and resource exhaustion. This feature can be disabled using the no ip proxy-arp interface command
- Secure routing protocols and FHRPs using Message Digest 5 (MD5) authentication in the domain. This prevents the injection of false routing information into the domain. Also consider additional protocol functions, such as limiting the size of the LSDB when using OSPF, for example, to protect the routing protocol implemented in the network
The Forwarding Plane
The forwarding or data plane is responsible for the actual forwarding of data. The data plane is typically populated using information derived from the control plane. This plane is used to determine the physical next hop egress interface for received packets or frames and then forwards the packets or frames using the correct egress interface. The forwarding or data plane can be secured by implementing ACLs, which can take the form of Routed ACL (RACLs), Port ACLs (PACLs) or VLAN ACLs (VACLs) in Cisco IOS Catalyst switches. Additional security considerations for the forwarding or data plane include the following:
- Depending on your network, consider dropping packets that have IP options if there is no legitimate reason for such packets on the network. As stated earlier in this guide, packets with IP options are punted to the CPU and processed in software. A large number of these packets can greatly increases CPU utilization on the device. The device can be configured to drop such packets using the ip options drop global configuration command
- Disable source routing which allows the source of the IP packet to specify the network path a packet takes. This functionality can be used in attempts to route traffic around security controls in the network. IP source routing is enabled by default; however, this can be disabled using the no ip source-route global configuration command
- Disable IP directed Broadcasts, which make it possible to send an IP broadcast packet to a remote IP subnet. This functionality has been used to facilitate smurf attacks. A Smurf Attack is also commonly referred to as a Ping Flood or ICMP Flood. This attack sends large amounts of ICMP packets to a machine in order to attempt to crash the TCP/IP stack on the machine and cause it to stop responding to TCP/IP requests. By default, directed Broadcasts are disabled, but if enabled, use the no ip directed-broadcast interface configuration command to disable this feature
- Implement anti-spoofing techniques such as Unicast Reverse Path Forwarding (RPF) and IP Source Guard. Unicast RPF enables a device to verify that the source address of a forwarded packet can be reached through the interface that received the packet. This feature is enabled using the ip verify unicast source reachable-via interface configuration command. IP Source Guard, commonly used with DHCP Snooping, restricts IP traffic on untrusted Layer 2 ports by filtering the traffic based on the DHCP snooping binding database or manually configured IP source bindings. The IP Source Guard feature is enabled by issuing the ip verify source interface configuration command on Layer 2 interfaces