As you and I take a look at hardening our network
infrastructure devices, I'd like you
to imagine that you and I have been called in, hired,
as consultants in a company to improve their security.
Now, ideally we'd have some direction as far as
what they're trying to focus on specifically.
But if they had no specific direction,
they said "improve security," we could break down their network
communications into three basic categories-- the management
plane, control plane, and data plane.
And then within each of those categories,
we could take a look at specific things
that we could do to improve their security by hardening WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we could do to improve their security by hardening
their network infrastructure devices.
So let's imagine that we go into the company,
and this is their network.
They've got some WAN connectivity, some VPN work.
They've got some routers and switches and firewalls.
And the benefit of compartmentalizing
the different types of traffic and different functions
allows us to focus on those aspects.
So let's start off with the management plane.
And a good question to start off with is OK,
what exactly is the management plane?
Well, the management plane is going
to involve the protocols and the methods
that we are going to use as administrators. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we are going to use as administrators.
Let's say that you and I are at this computer right here.
So this is us at this computer.
It's our management computer.
And the management plane is going to be the protocols that
we're using between us or our systems--
it can be a trusted management system--
and the devices-- between us and the switch,
between us and the router, between us
and the firewall, et cetera.
So some of the protocols that we'll often
find in this management plane that we're
using to manage and control and monitor our network
would include protocols such as SSH, and Simple Network
Management Protocol, and NetFlow, and FTP, and TFTP, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Management Protocol, and NetFlow, and FTP, and TFTP,
and AAA commands--
I'll just put AAA here, like TACACS+ and RADIUS,
and Network Time Protocol, and Syslog.
And the list goes on.
But the key is protocols that are being used between us
or our management systems and the infrastructure devices.
And one of the really great reasons
to compartmentalize that type of traffic is it
narrows our focus.
Instead of looking at every possible security
option and, like, application security and everything else,
we can focus on that and how we can protect that, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we can focus on that and how we can protect that,
that management traffic and those protocols
as part of upping or increasing the security
of the infrastructure as a whole.
Now, besides the management plane,
we also have the control plane that we can focus
on and improve that as well.
So for the control plane, I'll put that in red.
And when I think of the control plane,
I think of the applications and protocols and services that
are operating between devices.
For example, if we have a couple of routers
and are running a routing protocol,
so that routing protocol is informing or helping
that router to educate itself regarding forwarding of traffic WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that router to educate itself regarding forwarding of traffic
based on Layer 3 addresses.
Another example of that would be the MAC address
table on a Layer 2 switch is being populated dynamically,
and that is instructing how that switch, in the future,
is going to be forwarding frames based on Layer 2 addresses.
So we can think about the control plane
like an air traffic controller, which is giving instructions
on how to do something.
So when a switch needs to discover,
how do I forward these frames, or a router,
how do I forward these packets, the protocols involved,
like a routing protocol, is manipulate that control
plane, which is giving instructions
on how to do something. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
on how to do something.
So protocols that would operate at the control plane
would include things like routing protocols, spanning
tree, spanning tree protocol for a Layer 2 switch,
instructing which ports are being
forwarding, which ports are going to be blocking
or discarding.
The MAC address tables in a switch,
which are dynamically populated, that's
part of the control plane.
And one of the key elements here regarding the control plane
is that, if the control plane fails and the switches don't
correctly forward at Layer 2, and the routers don't correctly
forward at Layer 3, basically everything else
goes to heck in a handbasket. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
goes to heck in a handbasket.
Because if this is us, and we're trying to manage a router out
here but the control plane is broken so these routers don't
know how to forward, we're going to have a tough time,
as the administrator with our management traffic,
even reaching that device or communicating with that device
if the network is broken because of a failure of the control
plane.
So we want to harden our devices to protect the control
plane of our routers and switches
so that the control plane can be healthy and correctly educate
and instruct the devices on how to forward traffic.
And then last but not least, the third compartment or container
that we can look at for improving our security WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that we can look at for improving our security
and doing infrastructure hardening
would be regarding the data plane.
And data plane is for just plain Jane, average user traffic.
So Bob, the user, going out to a server
or going out to the internet, that traffic flowing
through the network, that would be considered data plane
traffic.
So we'll put that up here as well, data plane.
And when I think of data plane, if we have this user, Bob,
here at computer one, the data plane traffic
is traffic that's going through the network.
So if Bob is going to a server, his traffic making
go like this, down a trunk, through this route, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
go like this, down a trunk, through this route,
through the firewall, up to the server.
Or it might go through our network
and then be NATted out to the internet.
But you notice, Bob's data plane traffic
is not stopping at the router.
Bob is not-- or hopefully he's not
trying to initiate a session with the router itself
or with the switch or other infrastructure devices.
Data plane traffic is going through our network,
not to our network devices.
And to compare and contrast that, if this is you
and I at this management computer
and we're SSHing to a switch or to a router, that
would be considered management plane
traffic because we are using it for management of the network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
traffic because we are using it for management of the network.
So even though the packet from Bob and the packet from us
might go over the same network, if we're going to a router
to manage it with one of these protocols,
that would be considered management plane traffic.
And if Bob is trying to use the network to go through it,
that would be considered data plane traffic.
So now that we have each of those planes kind of segmented
into their functions, we could take each one of those aspects
and say, you know what?
What could we do for the infrastructure devices,
the routers and the switches, to help harden those devices,
to make them less vulnerable to compromises or attacks WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to make them less vulnerable to compromises or attacks
regarding each of those planes.
And that's the discussion I'd like to continue
with you in the next video.
So I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.