Configuring Switches Without Control Plane Protocols
As shown in Chapter 12, "Introduction to Denial of Service Attacks," a control plane in an Ethernet switch consists mainly of the following protocols:
• L2 processing. A switch must process and respond to Spanning Tree Protocol (STP), Link Aggregation Control Protocol (LACP), Port Aggression Protocol (PAgP), IEEE 802.1X, Cisco Discovery Protocol (CDP), Dynamic Trunking Protocol (DTP), VLAN Trunking Protocol (VTP), and keepalive packets.
• Internet Control Message Protocol (ICMP). ICMP packets must be processed, not only for responding to pings (this is the ping command sending an ICMP echo request), but to send signals to a host, such as ICMP Destination Unreachable, ICMP Redirect, ICMP Time Exceeded, and so on.
• L3 processing. If a switch is part of a Layer 3 domain and performs routing between VLANs, it will usually have to process routing updates from its neighbors. Also, packets with IP options and packets, which expire on the switch (TTL=1), need special handling. Address Resolution Protocol (ARP) is part of this class.
• Management traffic. Usually, there will be no physical isolation between the management plane and the control plane, resulting in management plane packets being funneled through the control plane. This includes Telnet, Secure Shell (SSH), Simple Network Management Protocol (SNMP), and Secure Socket Layer (SSL) packets.
In a Nutshell: Data Plane Versus Control Plane
The difference between data and control planes can be simplified as follows:
• Data plane. Traffic going through the switch, mainly end-user data
• Control plane. Traffic addressed to the switch (unicast or multicast), rarely sent by an end user
Some data plane packets can explicitly be addressed to one of the Ethernet or IP addresses of the switch. The switch processor processes them, but, strictly speaking, they are data plane packets.
Several of these protocols are useful mainly when the network node on the other side of the link is also an Ethernet switch or IP router. Therefore, it is a good idea to reduce the switch's denial of service (DoS) exposure by disabling the protocols that are not needed on access ports (defined as connecting to end stations). This technique is more efficient than CoPP.
Table 14-1 summarizes where the different control plane activities are required.
Table 14-1 Control Plane Activities in a Switch
Table 14-1 summarizes where the different control plane activities are required.
Table 14-1 Control Plane Activities in a Switch
|
Control Plane Activity |
Access Port (To an End-User Host) |
Network Port (To a Switch or Router) |
|
Spanning Tree Protocol (STP) |
No |
Only if bridging |
|
LACP |
No |
Only if links are aggregated |
|
PAgP |
No |
Only if links are aggregated |
|
IEEE 802.1X |
Yes |
Usually not |
|
CDP |
Only for Cisco IP Phones |
Yes |
|
DTP |
No |
Yes |
|
VTP |
No (except for some servers) |
Only if VLAN are spanning multiple switches |
|
Ethernet keepalives |
Yes |
Yes |
|
ICMP generation for TTL exceeded |
Maybe |
Maybe |
|
ICMP generation for port or protocol unreachable |
Maybe |
Maybe |
|
ICMP generation for destination unreachable |
Maybe |
Maybe |
|
ARP |
Yes |
Yes |
|
Control Plane Activity |
Access Port (To an End-User Host) |
Network Port (To a Switch or Router) |
|
Only if running IPv6 |
Only if running IPv6 |
|
|
IPv6 packet forwarding on platform where IPv6 is not implemented in hardware |
Only if running IPv6 |
Only if running IPv6 |
|
All management protocols: SNMP, SSH, Telnet, and so on |
No (except in the Network Operation Center) |
Yes |
|
Routing protocols |
No |
Yes |
The rest of this chapter analyzes which activities can be safely disabled on nontrusted access ports, assuming that those ports connect to an end station and not to another switch or router. Some activities cannot be disabled without having a major impact on the network, but this is not a reason not to disable the others. Although the mandatory protocols are a potential target for a DoS attack, removing some protocols reduces the risk exposures (especially when the DoS attacks are not coming from a targeted attack but from a misconfiguration).
Continue reading here: Disabling STP
Was this article helpful?