Hello, and welcome back.
When we started our journey, our focus
is to harden Cisco IOS devices.
In the previous video, we looked at several techniques
that we can use to harden a Cisco IOS device regarding
the management plane.
In this video, I'd like to focus on how we can harden our Cisco
IOS devices with aspects related to the control plane.
And we are going to use our Cisco doc
that we have been using once again for hardening, focusing
now on the control plane.
Now, when I think of control plane,
the primary thing I think about is routing protocols.
So if we've got Router 1 here and Router 2 here, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we've got Router 1 here and Router 2 here,
and they are exchanging routing protocols--
it could be OSPF, IS-IS, RIP, EIGRP,
BGP with external or internal, doesn't matter.
We want to make sure that the routing protocol is
successful and able to work.
And the best way of doing that is with authentication.
Because let me tell you what.
Without authentication, somebody, almost anybody,
could plug a router-- let's call this Router 3.
Let's say Bob owns that.
He brought it in from home, or he got on eBay, whatever.
He plugs it in.
He's running OSPF.
And now he's participating as part of an OSPF router WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And now he's participating as part of an OSPF router
on your network.
And if he's malicious, he could advertise default routes,
manipulate the metric or the cost for those routes,
and potentially have the other devices believe
that he is the best path for routing traffic off
of the local network.
So authentication, and not giving Bob the keys,
are an important aspect in protecting
the control plane regarding any of the routing protocols.
So that would address BGP and also internal gateway
routing protocols as well.
And then with BGP, there's other features WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then with BGP, there's other features
that we can use, including TTL-based security protections
and requiring the neighbor to be a certain number of hops away
in order to be willing to communicate with them
and filtering with prefix lists and filtering with AS path
lists, again with the intention of not being lied to or misled.
Another aspect regarding control plane hardening
is with ICMP redirects and ICMP unreachables and proxy ARP.
Now, these features are not bad in and of themselves.
So if we have a router like Router 1,
and it's connected to a network, and it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and it's connected to a network, and it
knows how to reach a few networks down here,
if a client sends a packet and that packet hits the router
and the router doesn't go around for it,
the router is very kind.
And it's going to send an unreachable message-- that's
this guy right here-- saying, hey,
regarding this packet you were trying to send, you know what?
I don't know how to get there.
I can't get there.
So you might want to try it some other way.
And that would be an ICMP unreachable
that R1 is sending back to this PC.
Now, if this is a hacker or an attacker,
and the attacker knows that this feature is enabled--
and it is enabled on many devices--
the hacker could starts flooding packets, lots of packets, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the hacker could starts flooding packets, lots of packets,
or maybe even a distributed denial of service attack,
flooding packets to a router where it knows that router
can't reach it and doesn't have a default router,
something to that effect.
Then the router is then busy, tied up
sending ICMP unreachable messages all day and all night.
Also, with an attacker who's trying
to discover the network, if R1 is sending ICMP ureachables
for certain subnets, the hacker is paying attention to that,
saying, oh, that subnet doesn't exist.
That subnet doesn't exist.
So in that aspect, it could be a security risk as well.
An ICMP redirect is when the router is sending an ICMP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
An ICMP redirect is when the router is sending an ICMP
message back to the device, saying, hey,
here's a better path or here's a better next hop.
And again, many of these features
are important to have on.
But if they're not needed, and you're sure of it
because you've done testing in your environment,
you could turn off those features
and then have a much more secure posture,
which would be an example of hardening our Cisco IOS device.
And here is yet one more that a lot of people use
and they don't know that they're using it.
And that is proxy ARP.
So if we have a router here, call it Router 1.
And let's imagine we have a device right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's imagine we have a device right here.
And let's say the router is at 10.10.10.--
and it has a host address of 1 with a 24-bit mask.
And this PC has been--
let's say it's been configured.
Let's say this PC believes it's on 10.20 network .30.--
and let's say the host addresses is 50, all right,
with the 24-bit mask.
Well, if this PC is trying to reach 10.20.30.5, for example,
and it doesn't another Layer 2 address of 10.20.30.5, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and it doesn't another Layer 2 address of 10.20.30.5,
it will do an ARP request.
It's a broadcast.
Now, this router with proxy ARP on,
if it sees that broadcast, it says, oh,
you're looking for the Layer 2 address up this guy.
If proxy ARP is enabled and R1 knows how to reach that prefix
of 10.20.30 based on this routing table, it lies.
It proxy ARPs.
It ARPs on behalf of that device and says, oh, that's me.
And so this PC says, oh, the Layer 2 address
is the router's address.
He forwards it.
And then the router makes a routing decision.
And that's just one of the many aspects of what
proxy ARP can do for us. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
proxy ARP can do for us.
But if it's not needed, you could disable proxy ARP.
And that would improve the security posture of this device
because it's now not willing to respond to bogus ARP requests.
Then this discussion of limiting CPU impact of control plane
traffic is all about making sure the CPU on that router
isn't overwhelmed.
And the way we do that is, you just--
I'm not going to say kill.
That's not a good word.
I'm going to say "drop."
Drop packets before they impact the CPU.
So in an earlier discussion, we talked about control plane WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So in an earlier discussion, we talked about control plane
protection and control plane policing, where this is you
and this is me.
I guess I'll put you there and me there.
So our traffic is trusted, as we send traffic to the router.
And anybody else's who's trying to do SSH and other management
protocols, they can be dropped.
Or if we're not dropping them, they can be identified
and then they can be limited.
So a certain quantity of SSH traffic
that's not coming from you or me might be tolerated.
But once it reaches a threshold, the system
can drop it before actually handing it over WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
can drop it before actually handing it over
to the CPU for processing.
And so that kind of protection is implemented
with control plane policing and also with access control lists
that are going to identify traffic, like
from non-authorized users, and drop it before it even reaches
that infrastructure device.
And the other big one down here is the First Hop Redundancy
Protocols--
FHRP.
Now First Hop Redundancy Protocols, like HSRP and VRRP,
and GL--
OK, Load Balancing Protocol.
I always have to spell that one out.
Those are fantastic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Those are fantastic.
So if you have R1 and R2, and they are
connected to a common segment.
And then we have our user, Bob.
These guys, running one of these protocols,
can have a virtual IP address, which Bob is going
to use as the default gateway.
And we're good to go.
But by default, if we're not using
security or authentication, anybody
can actually join that party.
So we'd have Jim, who brought his router in from home
that he bought on eBay or what have you.
He connects into the network segment,
and now he's participating.
And Jim says, whoa, I'm just learning about HSRP or VRRP. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And Jim says, whoa, I'm just learning about HSRP or VRRP.
And maybe they set their priority better,
and they enable preempt.
And as a result, Jim now becomes the active or the master router
for the First Hop Redundancy Protocol.
And now packets are being sent to him,
which if he's an attacker, he can now do a man in the middle
before forwarding that packet onto the right next hop
on the way out.
So the key is, with First Hop Redundancy Protocols,
authentication once again.
That way Jim won't have the keys involved and the passwords.
And he won't be able to join the party.
So in this video, we've taken a look
at precautions we can take by hardening WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
at precautions we can take by hardening
our devices, primarily with authentication, so
that if devices are running a routing protocol that's
managing the control plane about how to forward packets,
we are protecting that infrastructure
device with authentication from rogue devices
jumping in and possibly swaying the attitude
or manipulating the routing path our devices are going to take.
OK.
The third plane I'd like to chat with you about hardening
Cisco IOS devices is regarding the data plane.
And we're going to do that in the next video.
I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And I'd like to thank you for viewing.