WEBVTT

1
00:00.000 --> 00:00.848 align:middle line:84%


2
00:00.848 --> 00:02.890 align:middle line:90%
As you and I take a look
at hardening our network

3
00:02.890 --> 00:04.390 align:middle line:90%
infrastructure
devices, I'd like you

4
00:04.390 --> 00:06.790 align:middle line:90%
to imagine that you and I
have been called in, hired,

5
00:06.790 --> 00:09.820 align:middle line:90%
as consultants in a company
to improve their security.

6
00:09.820 --> 00:12.940 align:middle line:90%
Now, ideally we'd have
some direction as far as

7
00:12.940 --> 00:15.380 align:middle line:90%
what they're trying to
focus on specifically.

8
00:15.380 --> 00:17.710 align:middle line:90%
But if they had no
specific direction,

9
00:17.710 --> 00:21.190 align:middle line:90%
they said "improve security," we
could break down their network

10
00:21.190 --> 00:24.010 align:middle line:90%
communications into three basic
categories-- the management

11
00:24.010 --> 00:26.020 align:middle line:90%
plane, control plane,
and data plane.

12
00:26.020 --> 00:28.175 align:middle line:90%
And then within each
of those categories,

13
00:28.175 --> 00:29.800 align:middle line:90%
we could take a look
at specific things

14
00:29.800 --> 00:32.980 align:middle line:90%
that we could do to improve
their security by hardening
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

14
00:29.800 --> 00:32.980 align:middle line:90%
that we could do to improve
their security by hardening

15
00:32.980 --> 00:34.855 align:middle line:90%
their network
infrastructure devices.

16
00:34.855 --> 00:36.730 align:middle line:90%
So let's imagine that
we go into the company,

17
00:36.730 --> 00:38.140 align:middle line:84%
and this is their network.

18
00:38.140 --> 00:40.420 align:middle line:90%
They've got some WAN
connectivity, some VPN work.

19
00:40.420 --> 00:43.090 align:middle line:90%
They've got some routers
and switches and firewalls.

20
00:43.090 --> 00:45.010 align:middle line:90%
And the benefit of
compartmentalizing

21
00:45.010 --> 00:47.410 align:middle line:90%
the different types of traffic
and different functions

22
00:47.410 --> 00:49.430 align:middle line:90%
allows us to focus
on those aspects.

23
00:49.430 --> 00:52.200 align:middle line:90%
So let's start off with
the management plane.

24
00:52.200 --> 00:54.140 align:middle line:90%
And a good question to
start off with is OK,

25
00:54.140 --> 00:55.912 align:middle line:90%
what exactly is the
management plane?

26
00:55.912 --> 00:57.370 align:middle line:90%
Well, the management
plane is going

27
00:57.370 --> 00:59.088 align:middle line:90%
to involve the protocols
and the methods

28
00:59.088 --> 01:00.880 align:middle line:90%
that we are going to
use as administrators.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

28
00:59.088 --> 01:00.880 align:middle line:90%
that we are going to
use as administrators.

29
01:00.880 --> 01:03.620 align:middle line:90%
Let's say that you and I are
at this computer right here.

30
01:03.620 --> 01:05.319 align:middle line:84%
So this is us at this computer.

31
01:05.319 --> 01:06.533 align:middle line:84%
It's our management computer.

32
01:06.533 --> 01:08.950 align:middle line:90%
And the management plane is
going to be the protocols that

33
01:08.950 --> 01:11.560 align:middle line:90%
we're using between
us or our systems--

34
01:11.560 --> 01:13.210 align:middle line:90%
it can be a trusted
management system--

35
01:13.210 --> 01:15.280 align:middle line:90%
and the devices-- between
us and the switch,

36
01:15.280 --> 01:16.822 align:middle line:90%
between us and the
router, between us

37
01:16.822 --> 01:18.050 align:middle line:84%
and the firewall, et cetera.

38
01:18.050 --> 01:19.570 align:middle line:90%
So some of the protocols
that we'll often

39
01:19.570 --> 01:21.237 align:middle line:90%
find in this management
plane that we're

40
01:21.237 --> 01:23.560 align:middle line:90%
using to manage and control
and monitor our network

41
01:23.560 --> 01:27.370 align:middle line:90%
would include protocols such
as SSH, and Simple Network

42
01:27.370 --> 01:33.820 align:middle line:90%
Management Protocol, and
NetFlow, and FTP, and TFTP,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

42
01:27.370 --> 01:33.820 align:middle line:90%
Management Protocol, and
NetFlow, and FTP, and TFTP,

43
01:33.820 --> 01:35.115 align:middle line:84%
and AAA commands--

44
01:35.115 --> 01:38.650 align:middle line:90%
I'll just put AAA here,
like TACACS+ and RADIUS,

45
01:38.650 --> 01:42.400 align:middle line:90%
and Network Time
Protocol, and Syslog.

46
01:42.400 --> 01:43.340 align:middle line:84%
And the list goes on.

47
01:43.340 --> 01:46.450 align:middle line:90%
But the key is protocols that
are being used between us

48
01:46.450 --> 01:49.732 align:middle line:90%
or our management systems and
the infrastructure devices.

49
01:49.732 --> 01:51.190 align:middle line:90%
And one of the
really great reasons

50
01:51.190 --> 01:53.107 align:middle line:90%
to compartmentalize that
type of traffic is it

51
01:53.107 --> 01:54.115 align:middle line:84%
narrows our focus.

52
01:54.115 --> 01:55.990 align:middle line:90%
Instead of looking at
every possible security

53
01:55.990 --> 01:58.450 align:middle line:90%
option and, like, application
security and everything else,

54
01:58.450 --> 02:00.715 align:middle line:90%
we can focus on that and
how we can protect that,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
01:58.450 --> 02:00.715 align:middle line:90%
we can focus on that and
how we can protect that,

55
02:00.715 --> 02:02.980 align:middle line:90%
that management traffic
and those protocols

56
02:02.980 --> 02:05.200 align:middle line:90%
as part of upping or
increasing the security

57
02:05.200 --> 02:07.160 align:middle line:90%
of the infrastructure
as a whole.

58
02:07.160 --> 02:09.410 align:middle line:90%
Now, besides the
management plane,

59
02:09.410 --> 02:11.590 align:middle line:90%
we also have the control
plane that we can focus

60
02:11.590 --> 02:13.520 align:middle line:84%
on and improve that as well.

61
02:13.520 --> 02:15.947 align:middle line:90%
So for the control plane,
I'll put that in red.

62
02:15.947 --> 02:17.530 align:middle line:90%
And when I think of
the control plane,

63
02:17.530 --> 02:20.830 align:middle line:90%
I think of the applications
and protocols and services that

64
02:20.830 --> 02:22.510 align:middle line:84%
are operating between devices.

65
02:22.510 --> 02:24.620 align:middle line:90%
For example, if we have
a couple of routers

66
02:24.620 --> 02:26.140 align:middle line:90%
and are running a
routing protocol,

67
02:26.140 --> 02:28.690 align:middle line:90%
so that routing protocol
is informing or helping

68
02:28.690 --> 02:31.390 align:middle line:90%
that router to educate itself
regarding forwarding of traffic
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

68
02:28.690 --> 02:31.390 align:middle line:90%
that router to educate itself
regarding forwarding of traffic

69
02:31.390 --> 02:33.010 align:middle line:84%
based on Layer 3 addresses.

70
02:33.010 --> 02:35.140 align:middle line:90%
Another example of that
would be the MAC address

71
02:35.140 --> 02:38.590 align:middle line:90%
table on a Layer 2 switch is
being populated dynamically,

72
02:38.590 --> 02:40.960 align:middle line:90%
and that is instructing how
that switch, in the future,

73
02:40.960 --> 02:43.475 align:middle line:90%
is going to be forwarding frames
based on Layer 2 addresses.

74
02:43.475 --> 02:45.100 align:middle line:90%
So we can think about
the control plane

75
02:45.100 --> 02:47.710 align:middle line:90%
like an air traffic controller,
which is giving instructions

76
02:47.710 --> 02:49.280 align:middle line:84%
on how to do something.

77
02:49.280 --> 02:50.980 align:middle line:90%
So when a switch
needs to discover,

78
02:50.980 --> 02:52.840 align:middle line:90%
how do I forward these
frames, or a router,

79
02:52.840 --> 02:55.480 align:middle line:90%
how do I forward these packets,
the protocols involved,

80
02:55.480 --> 02:57.970 align:middle line:90%
like a routing protocol,
is manipulate that control

81
02:57.970 --> 02:59.530 align:middle line:90%
plane, which is
giving instructions

82
02:59.530 --> 03:01.190 align:middle line:84%
on how to do something.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

82
02:59.530 --> 03:01.190 align:middle line:84%
on how to do something.

83
03:01.190 --> 03:03.910 align:middle line:90%
So protocols that would
operate at the control plane

84
03:03.910 --> 03:06.910 align:middle line:90%
would include things like
routing protocols, spanning

85
03:06.910 --> 03:09.195 align:middle line:90%
tree, spanning tree protocol
for a Layer 2 switch,

86
03:09.195 --> 03:10.570 align:middle line:90%
instructing which
ports are being

87
03:10.570 --> 03:12.570 align:middle line:90%
forwarding, which ports
are going to be blocking

88
03:12.570 --> 03:13.420 align:middle line:84%
or discarding.

89
03:13.420 --> 03:15.155 align:middle line:90%
The MAC address
tables in a switch,

90
03:15.155 --> 03:16.780 align:middle line:90%
which are dynamically
populated, that's

91
03:16.780 --> 03:18.240 align:middle line:84%
part of the control plane.

92
03:18.240 --> 03:20.740 align:middle line:90%
And one of the key elements
here regarding the control plane

93
03:20.740 --> 03:23.898 align:middle line:90%
is that, if the control plane
fails and the switches don't

94
03:23.898 --> 03:26.440 align:middle line:90%
correctly forward at Layer 2,
and the routers don't correctly

95
03:26.440 --> 03:28.840 align:middle line:90%
forward at Layer 3,
basically everything else

96
03:28.840 --> 03:30.160 align:middle line:84%
goes to heck in a handbasket.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
03:28.840 --> 03:30.160 align:middle line:84%
goes to heck in a handbasket.

97
03:30.160 --> 03:33.130 align:middle line:90%
Because if this is us, and we're
trying to manage a router out

98
03:33.130 --> 03:35.680 align:middle line:90%
here but the control plane is
broken so these routers don't

99
03:35.680 --> 03:37.930 align:middle line:90%
know how to forward, we're
going to have a tough time,

100
03:37.930 --> 03:39.972 align:middle line:90%
as the administrator with
our management traffic,

101
03:39.972 --> 03:42.460 align:middle line:90%
even reaching that device or
communicating with that device

102
03:42.460 --> 03:45.050 align:middle line:90%
if the network is broken because
of a failure of the control

103
03:45.050 --> 03:45.550 align:middle line:84%
plane.

104
03:45.550 --> 03:48.910 align:middle line:90%
So we want to harden our
devices to protect the control

105
03:48.910 --> 03:51.260 align:middle line:90%
plane of our
routers and switches

106
03:51.260 --> 03:54.340 align:middle line:90%
so that the control plane can
be healthy and correctly educate

107
03:54.340 --> 03:57.265 align:middle line:90%
and instruct the devices
on how to forward traffic.

108
03:57.265 --> 03:59.890 align:middle line:90%
And then last but not least, the
third compartment or container

109
03:59.890 --> 04:02.230 align:middle line:90%
that we can look at for
improving our security
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
03:59.890 --> 04:02.230 align:middle line:90%
that we can look at for
improving our security

110
04:02.230 --> 04:03.730 align:middle line:90%
and doing
infrastructure hardening

111
04:03.730 --> 04:05.470 align:middle line:90%
would be regarding
the data plane.

112
04:05.470 --> 04:09.800 align:middle line:90%
And data plane is for just plain
Jane, average user traffic.

113
04:09.800 --> 04:11.887 align:middle line:90%
So Bob, the user,
going out to a server

114
04:11.887 --> 04:13.970 align:middle line:90%
or going out to the internet,
that traffic flowing

115
04:13.970 --> 04:16.420 align:middle line:90%
through the network, that
would be considered data plane

116
04:16.420 --> 04:17.329 align:middle line:84%
traffic.

117
04:17.329 --> 04:19.643 align:middle line:90%
So we'll put that up
here as well, data plane.

118
04:19.643 --> 04:22.060 align:middle line:90%
And when I think of data plane,
if we have this user, Bob,

119
04:22.060 --> 04:25.030 align:middle line:90%
here at computer one,
the data plane traffic

120
04:25.030 --> 04:26.990 align:middle line:90%
is traffic that's going
through the network.

121
04:26.990 --> 04:29.620 align:middle line:90%
So if Bob is going to a
server, his traffic making

122
04:29.620 --> 04:32.110 align:middle line:90%
go like this, down a
trunk, through this route,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

122
04:29.620 --> 04:32.110 align:middle line:90%
go like this, down a
trunk, through this route,

123
04:32.110 --> 04:34.180 align:middle line:90%
through the firewall,
up to the server.

124
04:34.180 --> 04:35.660 align:middle line:90%
Or it might go
through our network

125
04:35.660 --> 04:37.570 align:middle line:90%
and then be NATted
out to the internet.

126
04:37.570 --> 04:39.770 align:middle line:90%
But you notice, Bob's
data plane traffic

127
04:39.770 --> 04:41.020 align:middle line:84%
is not stopping at the router.

128
04:41.020 --> 04:42.850 align:middle line:90%
Bob is not-- or
hopefully he's not

129
04:42.850 --> 04:45.280 align:middle line:90%
trying to initiate a session
with the router itself

130
04:45.280 --> 04:47.650 align:middle line:90%
or with the switch or other
infrastructure devices.

131
04:47.650 --> 04:49.850 align:middle line:90%
Data plane traffic is
going through our network,

132
04:49.850 --> 04:51.430 align:middle line:84%
not to our network devices.

133
04:51.430 --> 04:53.500 align:middle line:90%
And to compare and contrast
that, if this is you

134
04:53.500 --> 04:55.330 align:middle line:90%
and I at this
management computer

135
04:55.330 --> 04:58.300 align:middle line:90%
and we're SSHing to a
switch or to a router, that

136
04:58.300 --> 04:59.800 align:middle line:90%
would be considered
management plane

137
04:59.800 --> 05:02.760 align:middle line:90%
traffic because we are using it
for management of the network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

137
04:59.800 --> 05:02.760 align:middle line:90%
traffic because we are using it
for management of the network.

138
05:02.760 --> 05:05.990 align:middle line:90%
So even though the packet from
Bob and the packet from us

139
05:05.990 --> 05:08.990 align:middle line:90%
might go over the same network,
if we're going to a router

140
05:08.990 --> 05:11.570 align:middle line:90%
to manage it with one
of these protocols,

141
05:11.570 --> 05:13.830 align:middle line:90%
that would be considered
management plane traffic.

142
05:13.830 --> 05:16.310 align:middle line:90%
And if Bob is trying to use
the network to go through it,

143
05:16.310 --> 05:18.393 align:middle line:90%
that would be considered
data plane traffic.

144
05:18.393 --> 05:20.810 align:middle line:90%
So now that we have each of
those planes kind of segmented

145
05:20.810 --> 05:23.350 align:middle line:90%
into their functions, we could
take each one of those aspects

146
05:23.350 --> 05:24.070 align:middle line:84%
and say, you know what?

147
05:24.070 --> 05:26.070 align:middle line:90%
What could we do for the
infrastructure devices,

148
05:26.070 --> 05:28.880 align:middle line:90%
the routers and the switches,
to help harden those devices,

149
05:28.880 --> 05:32.300 align:middle line:90%
to make them less vulnerable
to compromises or attacks
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

149
05:28.880 --> 05:32.300 align:middle line:90%
to make them less vulnerable
to compromises or attacks

150
05:32.300 --> 05:33.592 align:middle line:84%
regarding each of those planes.

151
05:33.592 --> 05:35.508 align:middle line:90%
And that's the discussion
I'd like to continue

152
05:35.508 --> 05:36.810 align:middle line:84%
with you in the next video.

153
05:36.810 --> 05:38.550 align:middle line:90%
So I'll see you there
in just a moment.

154
05:38.550 --> 05:40.970 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

155
05:40.970 --> 05:44.050 align:middle line:90%
And I'd like to thank
you for viewing.