Disabling STP
As shown in Chapter 3, "Attacking the Spanning Tree Protocol," STP can and should be disabled on an access port because an end host (workstation, printer, and so on) never sends IEEE 802.1d or 802.1w bridge protocol data units (BPDU). This can be done with the help of BPDU-guard:
IOS(config)# interface FastEthernet 0/0 IOS(config-if)# spanning-tree bpduguard enable
CatOS> (enable) set spantree bpdu-guard 2/47 enable
Spantree port 2/47 bpdu guard enabled.
Chapter 3 demonstrated that a DoS attack against STP was easy to mount with Yersinia sending 25,000 BPDU per second to a Catalyst 6500, bringing CPU utilization to 99 percent. As soon as BPDU-guard is enabled, CPU utilization returns back to normal.
Disabling Link Aggregation Protocols
Chapter 11, "Information Leaks with Cisco Ancillary Protocols," analyzes the risk linked to using link aggregation protocols, such as Cisco PAgP or IEEE LACP. Because end-user hosts typically do not require multiple Gbps (for most common applications), those protocols need to be disabled. In Cisco IOS switches, this is the default setting.
IOS(config)# interface FastEthernet 0/0 IOS(config-if)# no channel-group
Switch> (enable) set port channel 2/47 mode off Port(s) 2/47 channel mode set to off.
Disabling VTP
VTP is only useful on trunks between switches, so there's no reason to run VTP on an access port. Chapter 11 describes how to disable VTP on specific ports (which can only be done with version 3 of VTP—not available on Cisco IOS).
Console> (enable) set port vtp 2/47 disable
VTP is disabled on ports 3/1-2.
Disabling DTP
Chapter 4, "Are VLANs Safe?," presents all issues related to VLAN technologies and DTP. DTP must be disabled on nontrunking ports (like those facing end-user hosts).
IOS(config)# interface FastEthernet 0/0 IOS(config-if)# switchport mode access
Switch> (enable) set trunk 2/47 off Port(s) 2/47 trunk mode set to off.
Disabling Hot Standby Routing Protocol and Virtual Routing Redundancy Protocol
Chapter 9, "Is HSRP Resilient?," and Chapter 10, "Can We Bring VRRP Down?," explain that Hot Standby Routing Protocol (HSRP) and Virtual Router Redundancy Protocol (VRRP) can be protected by using ACL, as Example 14-1 shows, to forbid hosts to send
HSRP or VRRP packets to the switch. In Example 14-1, the addresses of the trusted routers are 10.10.100.1 and 10.10.100.2.
Example 14-1 Using ACL to Prevent VRRP and HSRP Spoofing
HSRP or VRRP packets to the switch. In Example 14-1, the addresses of the trusted routers are 10.10.100.1 and 10.10.100.2.
Example 14-1 Using ACL to Prevent VRRP and HSRP Spoofing
|
IOS(config)# ip |
access-list extended NEITHER_VRRP |
_NOR_ |
HSRP |
||||||
|
IOS(config |
ext- |
nacl) |
# |
remark Specific to VRRP |
|||||
|
IOS(config |
ext- |
nacl) |
# |
permit 112 host 10.10.100. |
1 |
host |
224.0 |
0.18 |
|
|
IOS(config |
ext- |
nacl) |
# |
permit 112 host 10.10.100. |
2 |
host |
224.0 |
0.18 |
|
|
IOS(config |
ext- |
nacl) |
# |
deny 112 any any |
|||||
|
IOS(config |
ext- |
nacl) |
# |
remark Specific to HSRP |
|||||
|
IOS(config |
ext- |
nacl) |
# |
permit udp host 10.10.100. |
1 |
host |
224.0 |
0.2 eq |
1985 |
|
IOS(config |
ext- |
nacl) |
# |
permit udp host 10.10.100. |
2 |
host |
224.0 |
0.2 eq |
1985 |
|
IOS(config |
ext- |
nacl) |
# |
deny udp any any eq 1985 |
|||||
|
IOS(config |
ext- |
nacl) |
# |
permit ip any any |
|||||
|
IOS(config |
ext- |
nacl) |
# |
exit |
|||||
|
IOS(config)# interface vlan 100 |
|||||||||
|
IOS(config |
if)# |
ip access-group NEITHER_VRRP_NOR_HSRP |
in |
||||||
|
IOS(config |
if)# |
exit |
|||||||
Disabling Management Protocols and Routing Protocols
All management protocols (SNMP, Telnet, SSH, and so on) are always forwarded to the switch's central processor when the destination IP address is any of the switch layer interfaces. Even a User Datagram Protocol (UDP) datagram for a nonexistent protocol is forwarded to the switch processor if it is explicitly addressed to one of the switch's IP addresses.
The only way to prevent an attacker from flooding the central processor with IP packets is to use an ACL to drop the IP packets sent specifically to the switch (and to the directed broadcast address of the subnet and the broadcast IP address of 255.255.255.255). Example 14-2 describes an ACL blocking all broadcast and directed broadcast (assuming a /24 subnet) packets while still allowing DHCP.
Example 14-2 ACL to Block All Broadcast Traffic
IOS(config)# ip access-list extended NO_BROADCAST
IOS(config-ext-nacl)# remark Drop all broadcast packets except DHCP IOS(config-ext-nacl)# permit udp any host 255.255.255.255 eq bootps IOS(config-ext-nacl)# deny ip any host 255.255.255.255 IOS(config-ext-nacl)# deny ip any 0.0.0.255 255.255.255.0
IOS(config-ext-nacl)# permit ip any any IOS(config-ext-nacl)# exit
A similar reasoning applies when routing protocols are enabled on a Layer 3 switch. Routing protocols' packets are sent to an IP group member's addresses, such as 224.0.0.5 and 224.0.0.6, for Open Shortest Path First (OSPF) or 224.0.0.10 for Enhanced Interior Gateway Routing Protocol (EIGRP). As soon as a Layer 3 interface is announced by a routing protocol (except for Border Gateway Protocol [BGP]), this interface becomes a member of those multicast groups. An IP ACL is enough to prevent flooding an OSPF group member's addresses, as Example 14-3 shows.
Example 14-3 ACL to Block All Packets Sent to OSPF Group Members
IOS(config)# ip access-list extended NO_OSPF IOS(config-ext-nacl)# deny ip any host 224.0.0.5 IOS(config-ext-nacl)# deny ip any host 224.0.0.6 IOS(config-ext-nacl)# permit ip any any IOS(config-ext-nacl)# exit
Using an ACL
As previously discussed, depending on the switch architecture, disabling a protocol might be useless to mitigate a DoS attack because the central processor drops the frames; therefore, the central processor is heavily loaded, and the DoS succeeds. On those switches, the only way left to prevent DoS attacks is to rely on MAC ACL. This ACL is hardware assisted and drops all frames without impacting the switch's central processor. For more information on ACL implementation in the switches, read Chapter 16, "Wire Speed Access Control Lists."
This ACL drops all frames, as Example 14-4 shows (from a Catalyst 6500 with Sup 720 running 12.2(18)SXF5, which allows the specification of an Ethertype directly in hexadecimal):
• Destined to Cisco multicast 0100.0CCC.CCCC. To prevent attacks against CDP (Ethertype 2003 in hexadecimal), VTP (Ethertype 2003), DTP (Ethertype 2004), and PAgP (Ethertype 0104)
• Destined to IEEE slow protocol 0180.C200.0002. To prevent attacks against LACP (Ethertype 8809)
Example 14-4 Defining a MAC ACL
|
IOS(config)# mac access-list |
extended |
CONTROL_PROTOCOLS_ACL |
|||||||
|
IOS(config |
ext |
macl)# |
permit |
any |
host |
0100.0ccc |
cccc |
0104 |
0 |
|
IOS(config |
ext |
macl)# |
permit |
any |
host |
0100.0000 |
cccc |
2000 |
0 |
|
IOS(config |
ext |
macl)# |
permit |
any |
host |
0100.0ccc |
cccc |
2003 |
0 |
|
IOS(config |
ext |
macl)# |
permit |
any |
host |
0100.0000 |
cccc |
2004 |
0 |
|
IOS(config |
ext |
macl)# |
permit |
any |
host |
0180.c200 |
0002 |
8809 |
0 |
|
IOS(config |
ext |
macl)# |
exit |
||||||
IOS(config)# vlan access-map CONTROL_PROTOCOLS_MAP 10 IOS(config-access-map)# match mac address CONTROL_PROTOCOLS_ACL
IOS(config-access-map)# action drop IOS(config-access-map)# exit
IOS(config)# vlan access-map CONTROL_PROTOCOLS_MAP 10 IOS(config-access-map)# match mac address CONTROL_PROTOCOLS_ACL
IOS(config-access-map)# action drop IOS(config-access-map)# exit
NOTE The specification of an Ethernet type, such as 2000, is not always possible on all switches. In this case, the ACL must match only on the host address 0100.0CCC.CCCC and 0180.C200.0002. This coarser ACL has the added benefit of completely blocking all Cisco and IEEE control plane protocols, even future or nonexistent ones. Depending on your configuration and security policy, you might want to use the coarse ACL rather than what Example 14-4 shows.
To block all IP packets destined to the Layer 3 VLAN interfaces (in this case, 10.10.10.1 and 10.10.100.1), an IP ACL must also be defined. It can be as simple as what Example 14-5 shows.
Example 14-5 Defining an IP ACL
|
IOS(config)# ip access-list extended PACKETS_TO_CPU |
||||||
|
IOS(config |
ext |
nacl |
# |
remark Permit the PING command |
||
|
IOS(config |
ext |
nacl |
# |
permit icmp any any echo |
||
|
IOS(config |
ext |
nacl |
# |
remark Drop all packets sent to |
a layer 3 interface and |
|
|
directed broadcast |
||||||
|
IOS(config |
ext |
nacl |
# |
deny ip any host 10.10.10.1 |
||
|
IOS(config |
ext |
nacl |
# |
deny ip any host 10.10.10.255 |
||
|
IOS(config |
ext |
nacl) |
# |
# two lines par layer 3 |
interface |
|
|
IOS(config |
ext |
nacl) |
# |
deny ip any host 10.10.100.1 |
||
|
IOS(config |
ext |
nacl) |
# |
deny ip any host 10.10.100.255 |
||
|
IOS(config |
ext |
nacl) |
# |
remark Drop all broadcast packets except DHCP |
||
|
IOS(config |
ext |
nacl) |
# |
permit udp any host 255.255.255. |
255 eq bootps |
|
|
IOS(config |
ext |
nacl) |
# |
deny ip any host 255.255.255.255 |
||
|
IOS(config |
ext |
nacl) |
# |
remark Specific to VRRP |
||
|
IOS(config |
ext |
nacl) |
# |
permit 112 host 10.10.100.1 host |
224.0.0.18 |
|
|
IOS(config |
ext |
nacl) |
# |
permit 112 host 10.10.100.2 host |
224.0.0.18 |
|
|
IOS(config |
ext |
nacl) |
# |
deny 112 any any |
||
|
IOS(config |
ext |
nacl) |
# |
remark Specific to HSRP |
||
|
IOS(config |
ext |
nacl) |
# |
permit udp host 10.10.100.1 host |
224.0.0.2 eq |
1985 |
|
IOS(config |
ext |
nacl) |
# |
permit udp host 10.10.100.2 host |
224.0.0.2 eq |
1985 |
|
IOS(config |
ext |
nacl) |
# |
deny udp any any eq 1985 |
||
|
IOS(config |
ext |
nacl) |
# |
remark Specific to OSPF |
||
|
IOS(config |
ext |
nacl) |
# |
deny ip any host 224.0.0.5 |
||
|
IOS(config |
ext |
nacl) |
# |
deny ip any host 224.0.0.6 |
||
|
IOS(config |
ext |
nacl) |
# |
remark Specific to RIP version 2 |
||
|
IOS(config |
ext |
nacl) |
# |
deny ip any host 224.0.0.9 |
||
|
IOS(config |
ext |
nacl) |
# |
remark Specific to EIGRP |
||
|
IOS(config |
ext |
nacl) |
# |
deny ip any host 224.0.0.10 |
||
|
IOS(config |
ext |
nacl) |
# |
remark All other IP packets are |
allowed |
|
|
IOS(config |
ext |
nacl) |
# |
permit ip any any |
||
|
IOS(config |
ext |
nacl) |
# |
exit |
||
The preceding IP ACL allows only the Internet Control Message Protocol (ICMP) echo request (for the ping command) and blocks all other packets addressed to any of the unicast addresses (and directed broadcast addresses) of the switch. Albeit being simple, its length depends on the number of Layer 3 interfaces of the switch. Defining a more generic ACL, such as Example 14-6, has the benefit of protecting downstream switches if the addressing scheme makes it simple. (This ACL can be kept simple.) In Example 14-6, assume that all the switches' layer interfaces are in the form of 10.10.*.1.
Example 14-6 Defining a More Generic IP ACL
IOS(config)# ip access-list extended PACKETS_TO_CPU
IOS(config-ext-nacl)# permit icmp any any echo
IOS(config-ext-nacl)# remark Drop all packets sent to a layer 3 interface IOS(config-ext-nacl)# deny ip any 10.10.0.1 0.0.255.0 IOS(config-ext-nacl)# remark Drop all directed broadcast IOS(config-ext-nacl)# deny ip any 10.10.0.255 0.0.255.0
IOS(config-ext-nacl)# remark Specific to VRRP
IOS(config-ext-nacl)# # and so on, all other lines from Example 14-5
IOS(config-ext-nacl)# exit
These access lists are then applied to all frames entering the VLAN 100 and all IP packets destined to any Layer 3 interface of the switch:
IOS(config)# vlan filter CONTROL_PROTOCOLS_MAP vlan-list 100
IOS(config)# interface vlan 100
IOs(config-if)# ip access-group PACKETS_TO_CPU in
NOTE Besides the protection against DoS attacks, the preceding ACL also makes the switch stealth. For example, a discovery tool, such as nmap, won't be able to detect the switch; this improves the network's operational security.
Continue reading here: Disabling Other Control Plane Activities
Was this article helpful?