Threats and Attack Mitigation
The technologies to mitigate the threats in an OOB network are slightly adjusted from the previous designs. In addition to the techniques described for the other management designs, a new concern must be dealt with: keeping the OOB network and the management network separate. There are several ways to achieve this:
• Separate address space By using separate address space for the management network, you can make it easy to filter production traffic from the management network and vice versa. An easy way to do this is to use dedicated RFC 1918 private addresses for the OOB network.
• Private VLANs Use private VLANs to stop traffic from one managed device from getting to another over the OOB network.
• Aggressively filter between OOB and production By having the OOB network on separate address space, you can easily set up filters at all choke points to block any traffic coming from or going to the OOB network.
• Use distribution lists to prevent route propagation To prevent the OOB network from being advertised or accepted by any other device, configure outbound and inbound distribution lists on all devices running routing protocols that are managed OOB.
• Filter within the OOB network Each OOB-managed device should have an inbound and an outbound ACL on the OOB-managed interface. These filters should allow only the specific management communications necessary between the management network and the managed devices. In addition, the management firewall should filter traffic to specific management flows.
As an example of managed host filtering, the following is the filtering that might be required on a Cisco IOS router managed by OOB. The 172.16.1.0/24 network is used for the managed device's OOB interfaces, and the 172.16.128.0/24 network is used for the management hosts. The topology is shown in Figure 16-8.
! Sample ACLs for R1
! Permit ICMP on the management network (you could be more restrictive if desired) access-list 101 permit icmp any any
! Permit established TCP session from the management network to the router !(TACACS+ responses).
access-list 101 permit tcp 172.16.128.0 0.0.0.255 host 172.16.1.25 established ! Permit UDP high ports, necessary for TFTP (see earlier in this chapter) access-list 101 permit udp 172.16.128.0 0.0.0.255 host 172.16.1.25 gt 1023 ! Permit SSH access to the router (telnet could be permitted as well if desired) access-list 101 permit tcp 172.16.128.0 0.0.0.255 host 172.16.1.25 eq 22 ! Permit SNMP and TFTP requests from specific hosts within the management network access-list 101 permit udp host 172.16.128.107 host 172.16.1.25 eq snmp access-list 101 permit udp host 172.16.128.110 host 172.16.1.25 eq tftp ! Permit NTP responses from the NTP server in the management network access-list 101 permit udp host 172.16.128.99 host 172.16.1.25 eq ntp access-list 101 deny ip any any log
! As you learned earlier in the book, ACLs on a router do not apply to ! traffic originated by the router. This means you only need one entry ! in the outbound ACL denying all traffic. This will stop traffic on ! the production network from being routed to the management network.
access-list 102 deny ip any any log !
interface FastEthernet0/0 ip address 172.16.1.25 255.255.255.0 ip access-group 101 in ip access-group 102 out
Figure 16-8. Out-of-Band Management Example
Figure 16-8. Out-of-Band Management Example
Continue reading here: Classified Network
Was this article helpful?