Disabling Other Control Plane Activities
Obviously some control plane activities cannot be disabled, even for access ports (for example, ICMP message generation, IEEE 802.1X, CDP, and IPv6 forwarding).
Generating ICMP Messages
ICMP unreachable messages are generated by the central processor and can lead to a DoS attack if the central processor spends its time just doing ICMP generation. This notably includes the following:
• Administratively prohibited. Occurs when an ACL drops a packet.
• TTL expired. Occurs when an IP packet with Time to Live (TTL) equal to 0 or 1 requires forwarding.
• Fragmentation required. Occurs when an IP packet is forwarded to an interface whose maximum transmission unit (MTU) is smaller than the packet size and the Don't Fragment bit is set in the IP header (typically used for Path MTU Discovery). This ICMP message is important for Path MTU Discovery, but because the switch has a default MTU of 1500 bytes on all interfaces (or even larger for high-speed Ethernet—the famous jumbo frames), this situation should never happen. Using another Layer 2 encapsulation, such as MPLS or IEEE 802.1Q in 802.1Q, can reduce the MTU, but these configurations are relatively rare; the best way to handle them is to use jumbo frames.
• Destination unreachable. Occurs when the packet cannot be forwarded because the destination address is not reachable. (For example, it is not in the routing table.) An ICMP message is never generated if the Layer 3 switch has a default route to a valid next hop. The incorrectly addressed IP packet is simply passed downstream, and it is up to the downstream router or switch to try to forward this packet. If the downstream node has a hardware-assisted CoPP, it resists a DoS attack.
All other cases of ICMP message generation might happen normally. It is better to ratelimit than completely block this generation because those ICMP messages are required for normal network operation. Alas, if CoPP does not exist in hardware, the ICMP rate limit is mostly done in software and is much less efficient.
The following command limits the generation of ICMP unreachables to—at most—once every 10 msec. ICMP message generation can also be completely disabled on a perinterface basis:
IOS(config)# ip icmp rate-limit unreachable 10
The following command only prevents ICMP message generation; the central processor still receives the packets requiring the transmission of an ICMP message. So, although this command is helpful, it won't always be hardware enforced and, therefore, it won't always be efficient:
IOS(config)# interface vlan 100
IOS(config-if)# no ip unreachables
Controlling CDP, IPv6, and IEEE 802.1X
As Chapter 11 discusses, CDP can safely be disabled on all access ports except on ports connecting to Cisco IP phones. This is because they rely on CDP to negotiate Power over Ethernet (PoE) and the voice VLAN ID. The ACL in Example 14-4 already prevented CDP packets from reaching the central processor. For more information on this ACL, see Chapter 11.
Even if IPv6 is forwarded in hardware on most Layer 3 switches, it is still process-switched by the central processor on some older platforms. If such switches are flooded with normal IPv6 packets, this leads to severe issues because the central processor has a CPU utilization of 100 percent. A good IPv6 design always relies on hardware-assisted IPv6 forwarding in switches. If this is not possible, a rate limiting of IPv6 traffic needs to be put in place. IPv6 packets have an Ethertype of 86DD.
Another protocol that might be required is IEEE 802.1X. (For more information about IEEE 802.1X, see Chapter 17, "Identity-Based Networking Services with 802.1X.") The default configuration is to have this protocol disabled, but be aware that this protocol is yet another control plane protocol. When IEEE 802.1X is enabled, install a rate limiter by configuring quality of service (QoS) commands for Ethertype 888E.
Example 14-7 defines a MAC ACL that can define a class of traffic to be policed on a Catalyst 6500 with a Sup 720 running 12.2(18)SXF5.
Example 14-7 MAC ACL to Define the IPv6 and 802.1X Classes
IOS(config)# mac access-list extended NEITHER_IPV6_NOR_DOT1X
IOS(config-ext-macl)# permit any any 888E 0
IOS(config-ext-macl)# permit any any 86DD 0 IOS(config-ext-macl)# exit
Using Smartports Macros
On some Cisco IOS versions (notably Catalyst 3750), there's a macro that, in a single line of the command-line interface (CLI), configures several recommended lines. This is the Smartports macro.
Smartports macros provide a convenient way to save and share common configurations. You can use Smartports macros to enable features and settings based on the location of a switch in the network and for mass configuration deployments across the network. Each Smartports macro is a set of CLI commands that you define. Smartports macros do not contain new CLI commands; they are simply a group of existing CLI commands.
When you apply a Smartports macro on an interface, the CLI commands within the macro are configured on the interface. When the macro is applied to an interface, the existing interface configurations are not lost. The new commands are added to the interface and are saved in the running configuration file.
Smartports macros exist for several access port configurations:
• cisco-desktop. Use when connecting a desktop device, such as a PC, to a switch port.
• cisco-phone. Use when connecting a desktop device, such as a PC with a Cisco IP Phone, to a switch port.
When applying the cisco-desktop macro to an access port, the following configuration lines are automatically generated (where $AVID is a parameter—the VLAN of the port), as Example 14-8 shows.
Example 14-8 Expansion of the cisco-desktop Macro switchport access vlan $AVID switchport mode access switchport port-security switchport port-security maximum 1 switchport port-security violation restrict switchport port-security aging time 2 switchport port-security aging type inactivity spanning-tree portfast spanning-tree bpduguard enable
It is straightforward to apply all the preceding settings to one port with the command macro apply. In this case, the parameter $AVID is set to 25:
IOS(config)#interface FastEthernet 0/0 IOS(config-if)# macro apply cisco-desktop $AVID 25
This is not a completely secure configuration because, by default, CDP, management protocols, and so on are still enabled on the port. Smartports macros can be edited, however. This can be an easy way to apply a more secure setting to multiple interfaces.
Continue reading here: Enabling Net Flow on a Catalyst 6500
Was this article helpful?