So, let's start off with the protection mechanism called an infrastructure ACL.
Now, what makes an extended access control list, which is really what it is,
what makes
it an eye ACL, infrastructure ACL?
Well, the big deal here is that we're trying to, or we want to reduce the risk
of people
who are trying to compromise our systems, for example, R1, R3, R2, R4.
So, what are some examples of something taking advantage of the systems?
Well, if we have something out here from the internet, for example, hopefully
we've got
some firewalls and stuff here to block that traffic initially. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
some firewalls and stuff here to block that traffic initially.
But an infrastructure ACL, its goal is to help protect access to these devices
from anyone
who is unauthorized.
So, let's imagine we have, just for grands, let's imagine this is our dress
base 25,
25, 25.0.
And let's imagine that's what we're using for the management of our networks.
So, part of our access control list that we could use at the edges of our
network, for
example, right here, coming in and also right here at R1 coming in, because we
have a user
right here, which is also a potential threat, we don't want anybody who is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
right here, which is also a potential threat, we don't want anybody who is
unauthorized
to be able to go ahead and manage our network devices or connect to our network
devices.
Because most traffic, for example, from this client going out to the internet,
that traffic
is going through our router environment, that's called transit traffic.
And what we want to do is protect against people who are trying to connect to
our specific
devices for the purposes of a denial of service or to hack into our system or
to cause another
harm to our infrastructure.
So, the key here is for infrastructure ACLs, think of it like management access
to our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to our
network infrastructure devices.
And the infrastructure ACL is being one of our first lines of defense to
control that
access.
So, just for grands, let's imagine we're using this dress base for the
management of our
network.
We could also make sure that we're, when we're launching connections from
inside the company,
that we're also launching it from that source of the dress base.
So, this IP dressing space would be used, for example, just for the management
of our
devices and our management networks, and that wouldn't be any of our user
networks.
So, if we're going to place an access control list inbound here on this router,
that's going
to permit some traffic and deny other traffic, one of our first entries would WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to permit some traffic and deny other traffic, one of our first entries would
be to stop any
inbound traffic if we knew it was impossible traffic.
For example, if we have the address base of 25, 25, 25, 0 in here, and then we
have a
packet coming in, and it claims that it has a source address of 25 dot 25 dot
25 dot 25
dot something.
Of course, that's not a valid packet.
That's going to be a spoofing trying to send traffic into our network.
So, in this access control list, what you're going to call it, 101.
In that ACL, we'd probably want to have something like deny IP.
If it's sourced from 25 dot 25 dot 25 dot 0 slash 24, of course, we use wild WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If it's sourced from 25 dot 25 dot 25 dot 0 slash 24, of course, we use wild
card bits
to represent that space going to anywhere.
And that way, any spoof packets trying to come in from what appears to be 25 to
25,
25, we'd kill it and deny it right there.
Another good step would be to deny traffic that is listed in RFC 3330.
So, I'll put RFC 3330.
So, what's an example of RFC 3330 traffic?
Let's take a moment and just peek at the RFC.
So, here is RFC 3330 and it's documenting special use IPV for addresses. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So, here is RFC 3330 and it's documenting special use IPV for addresses.
So, example of that would be all zeros for a source IP address.
We don't block that.
There's the 10 from the RFC 1918 address base.
Here's the 127, which represents the loopback address, and the list goes on.
So, we want to block anything claiming to come from many of these source
addresses and
stop them right as they're trying to come in and include that as part of our
infrastructure
ACL.
Because any packets that are, for example, sourced from 127, trying to come
into our network,
those are going to be bogus. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
those are going to be bogus.
And while we're talking about packets to block, we should also be blocking in
bound packets
if, for whatever reason, they're claiming to come from the RFC 1918 address
base.
So here's RFC 1918 and as we all know and love this, here's the address spaces
that
we're looking at, the 10/8, the 1.62.16/12, and the 192.168/16.
Now, hopefully, other service providers and people on the internet are blocking
that type
of source IP address from ever making it onto the internet.
However, if it shows up with a source address, we want to block it and not let WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
However, if it shows up with a source address, we want to block it and not let
that traffic
come in.
So, we'd want to deny as source IP addresses, source addresses that are sourced
claiming
to come from the IP addresses associated with 3330 and also RFC 1918.
And just deny those right out of the gate.
So that'll not only protect your infrastructure, but it'll also help protect if
you're a transit
network.
It'll help prevent those bogus packets from making it through your network
going on to
another destination.
Now, another type of traffic we'd want to deny coming into our infrastructure
to our
management network address base would be fragments.
Because the hacker is being creative, they can leverage the way Cisco router WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Because the hacker is being creative, they can leverage the way Cisco router
handles fragments
and actually get some traffic through, even though other access control entries
may block
it or attempt to block it based on the way fragments are handled on a Cisco
router.
So we want to lie fragments destined to our address base of 252550.
Now, for a transit network, there may be fragments that we're forwarding
through the network.
We want to let them go.
So, for here, I'm going to just presume that that's our internal address base
here.
So we'll say deny fragments for TCP and for UDP and for ICMP.
Denied those fragments if they're destined to the 25 dot 25 dot 25 dot 25 dot WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Denied those fragments if they're destined to the 25 dot 25 dot 25 dot 25 dot
25 address
base.
Again, presuming that's the address space we're using for our internal routers
and switches
in infrastructure.
Another thing that we want to deny coming into our infrastructure address base
are options.
Because the somebody's trying to do strict source routing or the trainee other
tricks
with the IP protocol and they're using options to do it, we want to go ahead
and stop that
traffic right at the edge before forwarding those traffic with those options to
our 252525
address base.
Now, there may be some traffic that we do need to allow to this address base WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now, there may be some traffic that we do need to allow to this address base
that we're
using internally.
For example, we may want to go ahead and permit things such as BGP traffic from
specific
peers coming into our address base or even to specific IP addresses in our
address base.
And things like SSH with very specific source and destinations.
Again, we're focused on the addressing space here that we're using in our
enterprise.
We might want to allow some ICMP to our internal address base.
So, another list of three examples of protocols we might want to allow to the
25 dot 25 dot WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
25 dot 25 dot
25 address base.
And we make it more granular, including the actual hosts or destinations inside
of that
address base, including the actual IP addresses of the sources that would lock
it down further.
And then once we permit the traffic that we want to allow, we then go ahead and
deny
BGP, SSH, ICMP, etc., once again, going to our address base.
So, that way we're allowing the control and management traffic that we need to
allow in
and at the same time we're disallowing those other protocols to any of our
other devices
in the address base. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
in the address base.
So, this would be specific and this would be wide open for anything else that
you can
get caught with the specific permission.
And then to tell them to this, we want to go ahead and have a permit for pretty
much
everything else.
And that way, other traffic, for example, traffic that's transiting through our
network
going to a different location and not going to our management address base here
, that
could be allowed.
And we'll do some examples of this and demonstrate this as we go through these
videos together.
Now, in addition to setting up infrastructure ACLs to control access to and
management of
our network devices, we could also leverage on our routers a feature called WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
our network devices, we could also leverage on our routers a feature called
Control Plane
Policing.
So, let me clean this up and let's talk about using Control Plane Policing as
another infrastructure
security feature.
And to really appreciate Control Plane Policing, let me spell that out.
Let's talk about the mechanics first about how the technology of a control
plane policing
mechanism works and then we'll apply that concept of Control Plane Policing to
improving
our infrastructure security.
So, COPP has three basic elements. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So, COPP has three basic elements.
One, we want to identify the traffic or identify some traffic.
And based on what we're trying to identify, it's going to depend on what we're
trying
to protect against.
So, for this overview, let's imagine that we still have our infrastructure ACL
right
here that's protecting most of our access to our infrastructure devices.
And let's imagine R1 has an IP address of 25.25.25.1.
So in our infrastructure ACL, we're permitting traffic, for example, from this
server, if
it's SSH to reach this device or from the server, if it's ICMP to reach this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it's SSH to reach this device or from the server, if it's ICMP to reach this
device.
So, for the example, let's imagine as part of Control Plane Policing, we want
to identify
let's imagine just ICMP traffic.
So, the first part of setting up Control Plane Policing is to set up an access
control list
just pointing to or identifying ICMP traffic with or without the source and
destination
that you want to use as part of that.
So, the next is Control List, it can be a permit, meaning match on ICMP from
any to any.
And boom, that's our first step instead of Control Plane Policing is creating WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And boom, that's our first step instead of Control Plane Policing is creating
access
to control list to identify the traffic that we want to take action on.
Now, once we're at an access control list to identify that traffic, we're also
going
to create something called a class map that calls upon that access control list
and identifying
that traffic.
So, think of the identifying of the traffic as a two-step process using an ACL
to identify
the traffic and having a class map call upon that ACL.
And we'll have examples in this set of videos to help reinforce that.
So, the first step here again is to identify the traffic and that's done with
an access
control list and then a class map that's calling upon that access control list. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
control list and then a class map that's calling upon that access control list.
And the second step is saying what we want to do to that traffic.
For example, do we want to rate limit it or do we want to drop it?
And this is why anybody is specifying the actions we want to take.
So, let's imagine that for ICMP traffic, we're okay with some of it, but if it
reaches a
certain threshold, we want to go ahead and start dropping it.
So, that would be the action statement.
And that's done with a feature called a policy map.
And the third step is to specify where we want that to happen.
For example, if we want to rate limit ICMP traffic or we want to drop WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
For example, if we want to rate limit ICMP traffic or we want to drop
altogether ICMP
traffic, where do we want that to happen?
On interface, for example, as traffic is going in on the interface or even
better with control
plane policing, we can apply that to the control plane itself.
And in the Cisco router, we do that by going into control plane configuration
mode on the
router and then specifying the service policy that we want to use.
So, I'm going to write service policy right here and in parentheses, I'll put
control
plane because that's where we want to apply it.
And then the service policy says, I want to use this policy map and effectively
applies
it to the control plane. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
it to the control plane.
So, no matter where that traffic is coming in, if it's ICMP traffic, it's
coming in here
or here or here, that traffic is identified if it matches a permit statement.
The ACL in combination with the class map are identifying that traffic.
The policy map says what we want to do and if it's applied to the control plane
, that's
where it happens.
So, regardless of which interface that traffic comes in on, if the action is to
drop or to
limit it beyond a certain point, when that traffic shows up at the control
plane, that
traffic will be limited or dropped based on our instructions as part of the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
traffic will be limited or dropped based on our instructions as part of the
policy map.
And here's the great news.
In this set of videos, we are going to walk through demonstrations of each of
these components
and then once again, as I mentioned, I'll put you on a hands-on lab so you can
get practice
in working with infrastructure ACLs and also control plane policing.
So, I'll see you in the next video as we do a demonstration of setting up
infrastructure
ACLs on a Cisco router.