WEBVTT

1
00:00.000 --> 00:01.380 align:middle line:84%


2
00:01.380 --> 00:02.380 align:middle line:84%
Hello, and welcome back.

3
00:02.380 --> 00:03.963 align:middle line:90%
When we started our
journey, our focus

4
00:03.963 --> 00:06.040 align:middle line:84%
is to harden Cisco IOS devices.

5
00:06.040 --> 00:08.440 align:middle line:90%
In the previous video, we
looked at several techniques

6
00:08.440 --> 00:11.350 align:middle line:90%
that we can use to harden a
Cisco IOS device regarding

7
00:11.350 --> 00:12.790 align:middle line:84%
the management plane.

8
00:12.790 --> 00:15.610 align:middle line:90%
In this video, I'd like to focus
on how we can harden our Cisco

9
00:15.610 --> 00:19.228 align:middle line:90%
IOS devices with aspects
related to the control plane.

10
00:19.228 --> 00:20.770 align:middle line:90%
And we are going to
use our Cisco doc

11
00:20.770 --> 00:23.500 align:middle line:90%
that we have been using once
again for hardening, focusing

12
00:23.500 --> 00:25.430 align:middle line:84%
now on the control plane.

13
00:25.430 --> 00:26.890 align:middle line:90%
Now, when I think
of control plane,

14
00:26.890 --> 00:29.990 align:middle line:90%
the primary thing I think
about is routing protocols.

15
00:29.990 --> 00:33.070 align:middle line:90%
So if we've got Router 1
here and Router 2 here,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.990 --> 00:33.070 align:middle line:90%
So if we've got Router 1
here and Router 2 here,

16
00:33.070 --> 00:34.930 align:middle line:90%
and they are exchanging
routing protocols--

17
00:34.930 --> 00:37.960 align:middle line:90%
it could be OSPF,
IS-IS, RIP, EIGRP,

18
00:37.960 --> 00:40.928 align:middle line:90%
BGP with external or
internal, doesn't matter.

19
00:40.928 --> 00:42.970 align:middle line:90%
We want to make sure that
the routing protocol is

20
00:42.970 --> 00:44.320 align:middle line:84%
successful and able to work.

21
00:44.320 --> 00:46.682 align:middle line:90%
And the best way of doing
that is with authentication.

22
00:46.682 --> 00:47.890 align:middle line:84%
Because let me tell you what.

23
00:47.890 --> 00:51.190 align:middle line:90%
Without authentication,
somebody, almost anybody,

24
00:51.190 --> 00:53.385 align:middle line:90%
could plug a router--
let's call this Router 3.

25
00:53.385 --> 00:54.385 align:middle line:84%
Let's say Bob owns that.

26
00:54.385 --> 00:56.830 align:middle line:90%
He brought it in from home,
or he got on eBay, whatever.

27
00:56.830 --> 00:57.880 align:middle line:84%
He plugs it in.

28
00:57.880 --> 00:59.350 align:middle line:84%
He's running OSPF.

29
00:59.350 --> 01:02.680 align:middle line:90%
And now he's participating
as part of an OSPF router
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

29
00:59.350 --> 01:02.680 align:middle line:90%
And now he's participating
as part of an OSPF router

30
01:02.680 --> 01:03.410 align:middle line:84%
on your network.

31
01:03.410 --> 01:06.640 align:middle line:90%
And if he's malicious, he
could advertise default routes,

32
01:06.640 --> 01:09.850 align:middle line:90%
manipulate the metric or
the cost for those routes,

33
01:09.850 --> 01:12.550 align:middle line:90%
and potentially have the
other devices believe

34
01:12.550 --> 01:15.190 align:middle line:90%
that he is the best path
for routing traffic off

35
01:15.190 --> 01:16.760 align:middle line:84%
of the local network.

36
01:16.760 --> 01:19.300 align:middle line:90%
So authentication, and
not giving Bob the keys,

37
01:19.300 --> 01:21.700 align:middle line:90%
are an important
aspect in protecting

38
01:21.700 --> 01:24.550 align:middle line:90%
the control plane regarding
any of the routing protocols.

39
01:24.550 --> 01:27.520 align:middle line:90%
So that would address BGP
and also internal gateway

40
01:27.520 --> 01:28.790 align:middle line:84%
routing protocols as well.

41
01:28.790 --> 01:30.498 align:middle line:90%
And then with BGP,
there's other features
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

41
01:28.790 --> 01:30.498 align:middle line:90%
And then with BGP,
there's other features

42
01:30.498 --> 01:33.577 align:middle line:90%
that we can use, including
TTL-based security protections

43
01:33.577 --> 01:36.160 align:middle line:90%
and requiring the neighbor to
be a certain number of hops away

44
01:36.160 --> 01:38.260 align:middle line:90%
in order to be willing
to communicate with them

45
01:38.260 --> 01:42.340 align:middle line:90%
and filtering with prefix lists
and filtering with AS path

46
01:42.340 --> 01:46.270 align:middle line:90%
lists, again with the intention
of not being lied to or misled.

47
01:46.270 --> 01:49.330 align:middle line:90%
Another aspect regarding
control plane hardening

48
01:49.330 --> 01:53.290 align:middle line:90%
is with ICMP redirects and ICMP
unreachables and proxy ARP.

49
01:53.290 --> 01:56.780 align:middle line:90%
Now, these features are not
bad in and of themselves.

50
01:56.780 --> 01:58.720 align:middle line:90%
So if we have a
router like Router 1,

51
01:58.720 --> 02:00.760 align:middle line:90%
and it's connected
to a network, and it
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

51
01:58.720 --> 02:00.760 align:middle line:90%
and it's connected
to a network, and it

52
02:00.760 --> 02:02.650 align:middle line:90%
knows how to reach a
few networks down here,

53
02:02.650 --> 02:05.633 align:middle line:90%
if a client sends a packet and
that packet hits the router

54
02:05.633 --> 02:07.300 align:middle line:90%
and the router doesn't
go around for it,

55
02:07.300 --> 02:08.360 align:middle line:84%
the router is very kind.

56
02:08.360 --> 02:10.610 align:middle line:90%
And it's going to send an
unreachable message-- that's

57
02:10.610 --> 02:12.190 align:middle line:90%
this guy right
here-- saying, hey,

58
02:12.190 --> 02:14.500 align:middle line:90%
regarding this packet you were
trying to send, you know what?

59
02:14.500 --> 02:15.380 align:middle line:84%
I don't know how to get there.

60
02:15.380 --> 02:16.370 align:middle line:84%
I can't get there.

61
02:16.370 --> 02:18.520 align:middle line:90%
So you might want to
try it some other way.

62
02:18.520 --> 02:20.200 align:middle line:90%
And that would be
an ICMP unreachable

63
02:20.200 --> 02:22.270 align:middle line:90%
that R1 is sending
back to this PC.

64
02:22.270 --> 02:24.152 align:middle line:90%
Now, if this is a
hacker or an attacker,

65
02:24.152 --> 02:26.360 align:middle line:90%
and the attacker knows that
this feature is enabled--

66
02:26.360 --> 02:28.120 align:middle line:90%
and it is enabled
on many devices--

67
02:28.120 --> 02:31.420 align:middle line:90%
the hacker could starts flooding
packets, lots of packets,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

67
02:28.120 --> 02:31.420 align:middle line:90%
the hacker could starts flooding
packets, lots of packets,

68
02:31.420 --> 02:33.730 align:middle line:90%
or maybe even a distributed
denial of service attack,

69
02:33.730 --> 02:36.538 align:middle line:90%
flooding packets to a router
where it knows that router

70
02:36.538 --> 02:38.580 align:middle line:90%
can't reach it and doesn't
have a default router,

71
02:38.580 --> 02:39.650 align:middle line:84%
something to that effect.

72
02:39.650 --> 02:41.320 align:middle line:90%
Then the router is
then busy, tied up

73
02:41.320 --> 02:44.170 align:middle line:90%
sending ICMP unreachable
messages all day and all night.

74
02:44.170 --> 02:45.760 align:middle line:90%
Also, with an
attacker who's trying

75
02:45.760 --> 02:49.260 align:middle line:90%
to discover the network, if
R1 is sending ICMP ureachables

76
02:49.260 --> 02:51.760 align:middle line:90%
for certain subnets, the hacker
is paying attention to that,

77
02:51.760 --> 02:53.470 align:middle line:90%
saying, oh, that
subnet doesn't exist.

78
02:53.470 --> 02:55.100 align:middle line:84%
That subnet doesn't exist.

79
02:55.100 --> 02:57.920 align:middle line:90%
So in that aspect, it could
be a security risk as well.

80
02:57.920 --> 03:01.375 align:middle line:90%
An ICMP redirect is when the
router is sending an ICMP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

80
02:57.920 --> 03:01.375 align:middle line:90%
An ICMP redirect is when the
router is sending an ICMP

81
03:01.375 --> 03:03.410 align:middle line:90%
message back to the
device, saying, hey,

82
03:03.410 --> 03:05.595 align:middle line:90%
here's a better path or
here's a better next hop.

83
03:05.595 --> 03:06.970 align:middle line:90%
And again, many
of these features

84
03:06.970 --> 03:08.410 align:middle line:84%
are important to have on.

85
03:08.410 --> 03:10.850 align:middle line:90%
But if they're not needed,
and you're sure of it

86
03:10.850 --> 03:12.850 align:middle line:90%
because you've done testing
in your environment,

87
03:12.850 --> 03:14.440 align:middle line:90%
you could turn
off those features

88
03:14.440 --> 03:16.360 align:middle line:90%
and then have a much
more secure posture,

89
03:16.360 --> 03:19.720 align:middle line:90%
which would be an example of
hardening our Cisco IOS device.

90
03:19.720 --> 03:21.970 align:middle line:90%
And here is yet one more
that a lot of people use

91
03:21.970 --> 03:23.840 align:middle line:90%
and they don't know
that they're using it.

92
03:23.840 --> 03:25.630 align:middle line:84%
And that is proxy ARP.

93
03:25.630 --> 03:29.150 align:middle line:90%
So if we have a router
here, call it Router 1.

94
03:29.150 --> 03:31.430 align:middle line:90%
And let's imagine we
have a device right here.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

94
03:29.150 --> 03:31.430 align:middle line:90%
And let's imagine we
have a device right here.

95
03:31.430 --> 03:34.985 align:middle line:90%
And let's say the
router is at 10.10.10.--

96
03:34.985 --> 03:38.330 align:middle line:90%
and it has a host address
of 1 with a 24-bit mask.

97
03:38.330 --> 03:39.700 align:middle line:84%
And this PC has been--

98
03:39.700 --> 03:42.620 align:middle line:84%
let's say it's been configured.

99
03:42.620 --> 03:49.221 align:middle line:90%
Let's say this PC believes
it's on 10.20 network .30.--

100
03:49.221 --> 03:51.780 align:middle line:90%
and let's say the host
addresses is 50, all right,

101
03:51.780 --> 03:53.110 align:middle line:84%
with the 24-bit mask.

102
03:53.110 --> 03:57.130 align:middle line:90%
Well, if this PC is trying to
reach 10.20.30.5, for example,

103
03:57.130 --> 04:01.140 align:middle line:90%
and it doesn't another Layer
2 address of 10.20.30.5,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

103
03:57.130 --> 04:01.140 align:middle line:90%
and it doesn't another Layer
2 address of 10.20.30.5,

104
04:01.140 --> 04:03.410 align:middle line:84%
it will do an ARP request.

105
04:03.410 --> 04:04.570 align:middle line:84%
It's a broadcast.

106
04:04.570 --> 04:06.740 align:middle line:90%
Now, this router
with proxy ARP on,

107
04:06.740 --> 04:08.620 align:middle line:90%
if it sees that
broadcast, it says, oh,

108
04:08.620 --> 04:10.960 align:middle line:90%
you're looking for the
Layer 2 address up this guy.

109
04:10.960 --> 04:14.680 align:middle line:90%
If proxy ARP is enabled and R1
knows how to reach that prefix

110
04:14.680 --> 04:17.950 align:middle line:90%
of 10.20.30 based on this
routing table, it lies.

111
04:17.950 --> 04:18.964 align:middle line:84%
It proxy ARPs.

112
04:18.964 --> 04:21.339 align:middle line:90%
It ARPs on behalf of that
device and says, oh, that's me.

113
04:21.339 --> 04:23.545 align:middle line:90%
And so this PC says,
oh, the Layer 2 address

114
04:23.545 --> 04:24.820 align:middle line:84%
is the router's address.

115
04:24.820 --> 04:25.915 align:middle line:84%
He forwards it.

116
04:25.915 --> 04:27.790 align:middle line:90%
And then the router
makes a routing decision.

117
04:27.790 --> 04:29.748 align:middle line:90%
And that's just one of
the many aspects of what

118
04:29.748 --> 04:31.430 align:middle line:84%
proxy ARP can do for us.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

118
04:29.748 --> 04:31.430 align:middle line:84%
proxy ARP can do for us.

119
04:31.430 --> 04:34.643 align:middle line:90%
But if it's not needed, you
could disable proxy ARP.

120
04:34.643 --> 04:37.060 align:middle line:90%
And that would improve the
security posture of this device

121
04:37.060 --> 04:42.160 align:middle line:90%
because it's now not willing to
respond to bogus ARP requests.

122
04:42.160 --> 04:45.250 align:middle line:90%
Then this discussion of limiting
CPU impact of control plane

123
04:45.250 --> 04:49.180 align:middle line:90%
traffic is all about making
sure the CPU on that router

124
04:49.180 --> 04:50.260 align:middle line:84%
isn't overwhelmed.

125
04:50.260 --> 04:52.120 align:middle line:90%
And the way we do
that is, you just--

126
04:52.120 --> 04:53.252 align:middle line:84%
I'm not going to say kill.

127
04:53.252 --> 04:54.210 align:middle line:84%
That's not a good word.

128
04:54.210 --> 04:56.050 align:middle line:84%
I'm going to say "drop."

129
04:56.050 --> 04:58.620 align:middle line:90%
Drop packets before
they impact the CPU.

130
04:58.620 --> 05:01.910 align:middle line:90%
So in an earlier discussion,
we talked about control plane
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

130
04:58.620 --> 05:01.910 align:middle line:90%
So in an earlier discussion,
we talked about control plane

131
05:01.910 --> 05:05.900 align:middle line:90%
protection and control plane
policing, where this is you

132
05:05.900 --> 05:07.400 align:middle line:84%
and this is me.

133
05:07.400 --> 05:09.360 align:middle line:90%
I guess I'll put you
there and me there.

134
05:09.360 --> 05:12.860 align:middle line:90%
So our traffic is trusted, as
we send traffic to the router.

135
05:12.860 --> 05:15.560 align:middle line:90%
And anybody else's who's trying
to do SSH and other management

136
05:15.560 --> 05:17.750 align:middle line:84%
protocols, they can be dropped.

137
05:17.750 --> 05:20.660 align:middle line:90%
Or if we're not dropping
them, they can be identified

138
05:20.660 --> 05:21.950 align:middle line:84%
and then they can be limited.

139
05:21.950 --> 05:25.040 align:middle line:90%
So a certain quantity
of SSH traffic

140
05:25.040 --> 05:27.380 align:middle line:90%
that's not coming from you
or me might be tolerated.

141
05:27.380 --> 05:29.750 align:middle line:90%
But once it reaches a
threshold, the system

142
05:29.750 --> 05:31.850 align:middle line:90%
can drop it before
actually handing it over
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

142
05:29.750 --> 05:31.850 align:middle line:90%
can drop it before
actually handing it over

143
05:31.850 --> 05:33.540 align:middle line:84%
to the CPU for processing.

144
05:33.540 --> 05:35.480 align:middle line:90%
And so that kind of
protection is implemented

145
05:35.480 --> 05:38.733 align:middle line:90%
with control plane policing and
also with access control lists

146
05:38.733 --> 05:40.400 align:middle line:90%
that are going to
identify traffic, like

147
05:40.400 --> 05:43.400 align:middle line:90%
from non-authorized users, and
drop it before it even reaches

148
05:43.400 --> 05:44.960 align:middle line:84%
that infrastructure device.

149
05:44.960 --> 05:48.200 align:middle line:90%
And the other big one down here
is the First Hop Redundancy

150
05:48.200 --> 05:48.740 align:middle line:84%
Protocols--

151
05:48.740 --> 05:50.930 align:middle line:84%
FHRP.

152
05:50.930 --> 05:55.970 align:middle line:90%
Now First Hop Redundancy
Protocols, like HSRP and VRRP,

153
05:55.970 --> 05:56.480 align:middle line:84%
and GL--

154
05:56.480 --> 05:58.100 align:middle line:84%
OK, Load Balancing Protocol.

155
05:58.100 --> 05:59.840 align:middle line:90%
I always have to
spell that one out.

156
05:59.840 --> 06:00.750 align:middle line:84%
Those are fantastic.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

156
05:59.840 --> 06:00.750 align:middle line:84%
Those are fantastic.

157
06:00.750 --> 06:03.380 align:middle line:90%
So if you have R1
and R2, and they are

158
06:03.380 --> 06:04.720 align:middle line:84%
connected to a common segment.

159
06:04.720 --> 06:06.148 align:middle line:84%
And then we have our user, Bob.

160
06:06.148 --> 06:07.940 align:middle line:90%
These guys, running
one of these protocols,

161
06:07.940 --> 06:10.360 align:middle line:90%
can have a virtual IP
address, which Bob is going

162
06:10.360 --> 06:11.900 align:middle line:84%
to use as the default gateway.

163
06:11.900 --> 06:12.990 align:middle line:84%
And we're good to go.

164
06:12.990 --> 06:15.470 align:middle line:90%
But by default,
if we're not using

165
06:15.470 --> 06:17.960 align:middle line:90%
security or
authentication, anybody

166
06:17.960 --> 06:19.260 align:middle line:84%
can actually join that party.

167
06:19.260 --> 06:22.593 align:middle line:90%
So we'd have Jim, who brought
his router in from home

168
06:22.593 --> 06:24.260 align:middle line:90%
that he bought on
eBay or what have you.

169
06:24.260 --> 06:25.850 align:middle line:90%
He connects into
the network segment,

170
06:25.850 --> 06:27.350 align:middle line:84%
and now he's participating.

171
06:27.350 --> 06:30.650 align:middle line:90%
And Jim says, whoa, I'm just
learning about HSRP or VRRP.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

171
06:27.350 --> 06:30.650 align:middle line:90%
And Jim says, whoa, I'm just
learning about HSRP or VRRP.

172
06:30.650 --> 06:32.960 align:middle line:90%
And maybe they set
their priority better,

173
06:32.960 --> 06:34.460 align:middle line:84%
and they enable preempt.

174
06:34.460 --> 06:38.390 align:middle line:90%
And as a result, Jim now becomes
the active or the master router

175
06:38.390 --> 06:41.150 align:middle line:90%
for the First Hop
Redundancy Protocol.

176
06:41.150 --> 06:42.860 align:middle line:90%
And now packets are
being sent to him,

177
06:42.860 --> 06:45.380 align:middle line:90%
which if he's an attacker, he
can now do a man in the middle

178
06:45.380 --> 06:47.780 align:middle line:90%
before forwarding that packet
onto the right next hop

179
06:47.780 --> 06:48.720 align:middle line:84%
on the way out.

180
06:48.720 --> 06:51.140 align:middle line:90%
So the key is, with First
Hop Redundancy Protocols,

181
06:51.140 --> 06:52.700 align:middle line:84%
authentication once again.

182
06:52.700 --> 06:55.430 align:middle line:90%
That way Jim won't have the
keys involved and the passwords.

183
06:55.430 --> 06:57.120 align:middle line:90%
And he won't be able
to join the party.

184
06:57.120 --> 06:58.220 align:middle line:90%
So in this video,
we've taken a look

185
06:58.220 --> 07:00.050 align:middle line:90%
at precautions we
can take by hardening
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

185
06:58.220 --> 07:00.050 align:middle line:90%
at precautions we
can take by hardening

186
07:00.050 --> 07:02.510 align:middle line:90%
our devices, primarily
with authentication, so

187
07:02.510 --> 07:04.940 align:middle line:90%
that if devices are running
a routing protocol that's

188
07:04.940 --> 07:07.580 align:middle line:90%
managing the control plane
about how to forward packets,

189
07:07.580 --> 07:09.410 align:middle line:90%
we are protecting
that infrastructure

190
07:09.410 --> 07:11.960 align:middle line:90%
device with authentication
from rogue devices

191
07:11.960 --> 07:14.450 align:middle line:90%
jumping in and possibly
swaying the attitude

192
07:14.450 --> 07:17.480 align:middle line:90%
or manipulating the routing path
our devices are going to take.

193
07:17.480 --> 07:18.015 align:middle line:84%
OK.

194
07:18.015 --> 07:20.390 align:middle line:90%
The third plane I'd like to
chat with you about hardening

195
07:20.390 --> 07:23.510 align:middle line:90%
Cisco IOS devices is
regarding the data plane.

196
07:23.510 --> 07:25.470 align:middle line:90%
And we're going to do
that in the next video.

197
07:25.470 --> 07:27.390 align:middle line:90%
I'll see you there
in just a moment.

198
07:27.390 --> 07:29.750 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

199
07:29.750 --> 07:32.500 align:middle line:90%
And I'd like to thank
you for viewing.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

199
07:29.750 --> 07:32.500 align:middle line:90%
And I'd like to thank
you for viewing.

200
07:32.500 --> 07:33.000 align:middle line:84%